Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2020-14298

docker: Security regression of CVE-2019-5736 due to inclusion of vulnerable runc

The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Enterprise Linux Server Openshift Container Platform and 1 more
CVE-2019-20044

zsh: insecure dropping of privileges when unsetting PRIVILEGED option

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Ipados Iphone Os Mac Os X and 9 more
CVE-2019-11243

kubernetes: Authentication information exposure in rest.AnonymousClientConfig()

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed
Vendors
Kubernetes Netapp
Products
Kubernetes Trident
CVE-2018-7169

shadow-utils: newgidmap allows unprivileged user to drop supplementary groups potentially allowing privilege escalation

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

CVSS 3.0 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Shadow Project
Products
Shadow
CVE-2018-12615

passenger: privilege lowering in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

CVSS 3.0 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Phusion
Products
Passenger