ME
Product
Mesos
9
CVEs
0
On KEV
8.6
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 3Low 0
Watch
Add Mesos to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-5736 | 8.6 | Feb 11 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by… Affected: 1.4.0 before 1.4.3; 1.5.0 before 1.5.3; 1.6.0 before 1.6.2; 1.7.0 before 1.7.2 |
| CVE-2019-0204 | 7.8 | Mar 25 | A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions… Affected: 1.4.0 before 1.4.3; 1.5.0 before 1.5.3; 1.6.0 before 1.6.2; 1.7.0 before 1.7.2; 1.8.0 |
| CVE-2018-11793 | 7.5 | Mar 5 | When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might… Affected: 1.4.0 before 1.4.3; 1.5.0 before 1.5.2; 1.6.0 before 1.6.2; 1.7.0 before 1.7.1; 1.4.0; 1.4.0; +4 more |
| CVE-2018-1330 | 7.5 | Sep 13 | When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception Affected: 1.4.0 before 1.4.2; 1.5.0 before 1.5.1; 1.4.0; 1.4.0; 1.4.0; 1.4.0; +2 more |
| CVE-2017-9790 | 7.5 | Sep 29 | When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the… Affected: through 1.1.2; 1.2.0; 1.2.1; 1.3.0; 1.3.1; 1.4.0-dev |
| CVE-2017-7687 | 7.5 | Sep 29 | When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might… Affected: through 1.1.2; 1.2.0; 1.2.1; 1.3.0; 1.3.1; 1.4.0-dev |
| CVE-2018-1000421 | 6.5 | Jan 9 | An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test… Affected: through 0.17.1 |
| CVE-2018-1000420 | 6.5 | Jan 9 | An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials… Affected: through 0.17.1 |
| CVE-2018-8023 | 5.9 | Sep 21 | Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT) Affected: before 1.4.2; 1.5.0; 1.5.1; 1.6.0 |
Showing 9