https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:03:27 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-34630 cnvd-2020-34630 https://cve.radiocsirt.org/vuln/cnvd-2020-34630 https://cve.radiocsirt.org/vuln/euvd-2026-40365 EUVD-2026-40365 https://cve.radiocsirt.org/vuln/euvd-2026-40365 https://cve.radiocsirt.org/vuln/fkie_cve-2020-11075 <p>In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to &#39;root&#39; then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.</p> <p>In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to &#39;root&#39; then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-11075 https://cve.radiocsirt.org/vuln/gsd-2020-11075 gsd-2020-11075 https://cve.radiocsirt.org/vuln/gsd-2020-11075