CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 28/05/2021 |
| CVE-2020-15229 | CRITIQUE9.3 | Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host filesystem during the extraction with a crafted squashfs filesy | 14/10/2020 |
| CVE-2020-25040 | ÉLEVÉE8.8 | Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039. | 16/09/2020 |
| CVE-2020-25039 | ÉLEVÉE8.1 | Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution. | 16/09/2020 |
| CVE-2020-13846 | ÉLEVÉE7.5 | Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code. | 14/07/2020 |
| CVE-2020-13845 | ÉLEVÉE7.5 | Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature. | 14/07/2020 |
| CVE-2019-19724 | ÉLEVÉE7.5 | Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services. | 18/12/2019 |
| CVE-2019-11328 | ÉLEVÉE8.8 | An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can c | 14/05/2019 |
| CVE-2018-19295 | ÉLEVÉE7.8 | Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks. | 17/12/2018 |