Docker vulnerabilities, page 3
125 vulnerabilities
Known vulnerabilities in Docker products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 43 products.
CVE-2020-29389dockercrux_linux_docker_image
EPSS score1.73%
The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Linux Docker container deployed by affected versions of the Docker image may allow an attacker to achieve root access with a blank password.CVE-2020-29580dockerstorm_docker_imageEPSS score2.32%
The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.CVE-2020-29575dockerelixir_alpine_docker_imageEPSS score2.93%
The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.CVE-2020-29591dockerregistryEPSS score2.65%
Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank password.CVE-2020-29581dockerspiped_alpine_docker_imageEPSS score2.27%
The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.CVE-2020-27534chainguarddocker+32EPSS score1.77%
util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.CVE-2020-10665dockerdesktopEPSS score1.44%
Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0.CVE-2020-15360dockerdocker_desktopEPSS score0.68%
com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification.CVE-2020-35184dockercomposer_docker_imageEPSS score3.03%
The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.CVE-2020-35467dockerdocsEPSS score2.20%
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Docker Docs container may allow a remote attacker to achieve root access with a blank password.CVE-2020-35195dockerhaproxy_docker_imageEPSS score2.20%
The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.CVE-2020-35186dockeradminerEPSS score2.92%
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.CVE-2020-35196dockerrabbitmq_docker_imageEPSS score2.15%
The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. System using the rabbitmq docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.CVE-2020-35197dockermemcached_docker_imageEPSS score2.15%
The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. System using the memcached docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.CVE-2020-35185dockerghost_alpine_docker_imageEPSS score2.88%
The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.CVE-2014-0047debiandocker.io+2EPSS score0.39%
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.CVE-2014-0048apachegeode+4EPSS score7.28%
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.CVE-2014-9357chainguarddocker+18EPSS score6.20%
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.CVE-2014-9356chainguarddocker+19EPSS score4.92%
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.CVE-2014-9358chainguarddocker+19EPSS score2.53%
Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."