CVE Feed

In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages. Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend. As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop  v4.31.0 https://docs.docker.com/desktop/release-notes/#4310  additionally changes the default configuration to enable this setting by default.

In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode.

Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability

Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability

Windows Remote Desktop Licensing Service Denial of Service Vulnerability

Microsoft SharePoint Remote Code Execution Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

Microsoft Defender for IoT Elevation of Privilege Vulnerability

Windows Graphics Component Elevation of Privilege Vulnerability

Xbox Wireless Adapter Remote Code Execution Vulnerability

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Windows Remote Desktop Licensing Service Denial of Service Vulnerability

Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability

Windows Enroll Engine Security Feature Bypass Vulnerability

Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability

Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability

Windows Win32k Elevation of Privilege Vulnerability

Secure Boot Security Feature Bypass Vulnerability

BitLocker Security Feature Bypass Vulnerability

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Windows Workstation Service Elevation of Privilege Vulnerability

Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability

Windows Network Driver Interface Specification (NDIS) Denial of Service Vulnerability

PowerShell Elevation of Privilege Vulnerability

DHCP Server Service Remote Code Execution Vulnerability

PowerShell Elevation of Privilege Vulnerability

Microsoft Xbox Remote Code Execution Vulnerability

Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability

Windows Themes Spoofing Vulnerability

Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability

Windows Line Printer Daemon Service Denial of Service Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

Microsoft Outlook Spoofing Vulnerability

Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability

Microsoft Message Queuing Information Disclosure Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability