CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43403 – jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin
https://notcve.org/view.php?id=CVE-2022-43403
19 Oct 2022 — A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Una vulnerabilidad de omisión del sandbox que involucra la fundición de un valor de tipo array a un tipo de array en Jenkins Script Security Plugin versi... • http://www.openwall.com/lists/oss-security/2022/10/19/3 • CWE-693: Protection Mechanism Failure •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43404 – jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin
https://notcve.org/view.php?id=CVE-2022-43404
19 Oct 2022 — Una vulnerabilidad de omisión del sandbox que implica cuerpos de constructores diseñados y llamadas a constructores sintéticos generados por la sandbox en Jenkins Script Security Plugin versiones 1183.v774b_0b_0a_451 y anteriores, permite a atacantes con permiso para definir y ejecutar scripts con sandbox, incluyendo Pipelines, omitir la protección del sandbox y ejecutar código arbitrario en el contexto de la JVM del controlador de Jenkins A sandbox bypass vulnerability was found in several Jenkins p... • http://www.openwall.com/lists/oss-security/2022/10/19/3 • CWE-693: Protection Mechanism Failure •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43405 – jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin
https://notcve.org/view.php?id=CVE-2022-43405
19 Oct 2022 — A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Una vulnerabilidad de omisión del sandbox en Jenkins Pipeline: Groovy Libraries Plugin versiones 612.v84da_9c54906d y anteriores, permite a atacantes con perm... • http://www.openwall.com/lists/oss-security/2022/10/19/3 • CWE-693: Protection Mechanism Failure •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43406 – jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin
https://notcve.org/view.php?id=CVE-2022-43406
19 Oct 2022 — A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Una vulnerabilidad de omisión del sandbox en Jenkins Pipeline: Deprecated Groovy Libraries Plugin versiones 583.vf3b_454e43966 y anteriores, permit... • http://www.openwall.com/lists/oss-security/2022/10/19/3 • CWE-693: Protection Mechanism Failure •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3314 – Debian Security Advisory 5244-1
https://notcve.org/view.php?id=CVE-2022-3314
28 Sep 2022 — Use after free in logging in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. • https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html • CWE-416: Use After Free •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3308 – Debian Security Advisory 5244-1
https://notcve.org/view.php?id=CVE-2022-3308
28 Sep 2022 — Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. • https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html • CWE-602: Client-Side Enforcement of Server-Side Security •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-3309 – Debian Security Advisory 5244-1
https://notcve.org/view.php?id=CVE-2022-3309
28 Sep 2022 — Use after free in assistant in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via specific UI gestures. • https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html • CWE-416: Use After Free •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3311 – Debian Security Advisory 5244-1
https://notcve.org/view.php?id=CVE-2022-3311
28 Sep 2022 — Use after free in import in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. • https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html • CWE-416: Use After Free •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2022-3075 – Google Chromium Mojo Insufficient Data Validation Vulnerability
https://notcve.org/view.php?id=CVE-2022-3075
26 Sep 2022 — Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. ... Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. • https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html • CWE-20: Improper Input Validation •
CVSS: 8.3EPSS: 3%CPEs: 1EXPL: 1CVE-2022-40635 – Improper Control of Dynamically-Managed Code Resources in Crafter Studio
https://notcve.org/view.php?id=CVE-2022-40635
13 Sep 2022 — Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Una vulnerabilidad de Control Inapropiado de los Recursos de Código Administrados Dinámicamente en Crafter Studio de Crafter CMS permite a desarrolladores autenticados ejecutar comandos del Sistema Operativo por medio de Groovy Sandbox Bypass • https://github.com/mbadanoiu/CVE-2022-40635 • CWE-913: Improper Control of Dynamically-Managed Code Resources •