CVE-2017-10940

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsshar@1.0.0-release-20160901-20160901T051624Z-g3fd5adf (e469cf49-4de3-4658-8419-ab42837916ad). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the docker API. The process does not properly validate user-supplied data which can allow for the upload of arbitrary files. An attacker can leverage this vulnerability to execute arbitrary code under the context of root. Was ZDI-CAN-3853.

• CWE-22
• CWE-434

• http://www.securityfocus.com/bid/99510Third Party Advisory, VDB Entry
• https://help.joyent.com/hc/en-us/articles/115009649927-Security-Advisory-ZDI-CAN-3853-Docker-File-Overwrite-VulnerabilityVendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-453Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/99510Third Party Advisory, VDB Entry
• https://help.joyent.com/hc/en-us/articles/115009649927-Security-Advisory-ZDI-CAN-3853-Docker-File-Overwrite-VulnerabilityVendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-453Third Party Advisory, VDB Entry

Published

Oct 31, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-10934All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG pr…
• CVE-2017-10935All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2…
• CVE-2017-10936SQL injection vulnerability in all versions prior to V4.01.0…
• CVE-2017-10937SQL injection vulnerability in all versions prior to V2.01.0…
• CVE-2017-10938Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-10939Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-10941This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-10942This vulnerability allows remote attackers to disclose sensi…
• CVE-2017-10943This vulnerability allows remote attackers to disclose sensi…
• CVE-2017-10944This vulnerability allows remote attackers to disclose sensi…
• CVE-2017-10945This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-10946This vulnerability allows remote attackers to execute arbitr…