Priority MEDIUM 45
Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01258 · Published 2021-06-15 · No fix listed CWE-754
Priority MEDIUM 45
Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01289 · Published 2021-07-19 · No fix listed CWE-331
Priority MEDIUM 44
Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.02046 · Published 2020-10-14 · Fixed in 3.6.4 CWE-22
Priority MEDIUM 42
Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0204 · Published 2020-09-16 · Fixed in 3.6.3 CWE-668
Priority MEDIUM 42
An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02088 · Published 2019-05-14 · Fixed in 3.2.0 CWE-732
Priority LOW 39
Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.02014 · Published 2020-09-16 · Fixed in 3.6.3 CWE-668
Priority LOW 36
Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01336 · Published 2020-07-14 · Fixed in 3.6.0
Priority LOW 35
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed a…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01234 · Published 2019-12-18 · Fixed in 3.5.2 CWE-276
Priority LOW 34
Apptainer is an open source container platform for Linux.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00369 · Published 2023-04-25 · Fixed in 1.1.8 CWE-416
Priority LOW 34
Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00629 · Published 2020-07-14 · No fix listed CWE-354
Priority LOW 34
Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0047 · Published 2018-12-17 · Fixed in 2.6.1 CWE-20
Priority LOW 33
Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00517 · Published 2020-07-14 · Fixed in 3.6.0 CWE-347
Priority LOW 32
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01465 · Published 2018-07-05 · Fixed in 2.5.2 CWE-200
Priority LOW 31
Singularity is an open source container platform.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.01415 · Published 2021-05-28 · Fixed in 3.7.4 CWE-20
Priority LOW 25
Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00344 · Published 2021-04-06 · Fixed in 0.4.7 CWE-20
THREATIST.IORead the docs