Anchore
Monthly
Privilege escalation in Anchore Enterprise's user management API allows authenticated attackers to modify user permissions, granting write access to read-only users. Versions 5.11.0 through 5.27.1 and 6.0.0 are affected; patches are available in 5.27.2 and 6.0.1. No public exploit or active exploitation has been reported.
stereoscope is a go library for processing container images and simulating a squash filesystem. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in Anchore Enterprise's user management API allows authenticated attackers to modify user permissions, granting write access to read-only users. Versions 5.11.0 through 5.27.1 and 6.0.0 are affected; patches are available in 5.27.2 and 6.0.1. No public exploit or active exploitation has been reported.
stereoscope is a go library for processing container images and simulating a squash filesystem. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.