CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-25136
https://notcve.org/view.php?id=CVE-2019-25136
A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox escape. This vulnerability affects Firefox < 70. • https://bugzilla.mozilla.org/show_bug.cgi?id=1530709 https://www.mozilla.org/security/advisories/mfsa2019-34 •
CVSS: 8.6EPSS: 1%CPEs: 8EXPL: 0CVE-2023-32409 – Apple Multiple Products WebKit Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2023-32409
A remote attacker may be able to break out of Web Content sandbox. ... Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. • https://support.apple.com/en-us/HT213757 https://support.apple.com/en-us/HT213758 https://support.apple.com/en-us/HT213761 https://support.apple.com/en-us/HT213762 https://support.apple.com/en-us/HT213764 https://support.apple.com/en-us/HT213842 •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2023-32314 – Sandbox Escape
https://notcve.org/view.php?id=CVE-2023-32314
vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. ... As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. ... A flaw was found in the vm2 sandbox. When a host object is created based on the specification of Proxy, an attacker can bypass the sandbox protections. • https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf https://github.com/patriksimek/vm2/releases/tag/3.9.18 https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5 https://access.redhat.com/security/cve/CVE-2023-32314 https://bugzilla.redhat.com/show_bug.cgi?id=2208376 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.6EPSS: 0%CPEs: 5EXPL: 0CVE-2023-2136 – Google Chrome Skia Integer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2023-2136
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. • https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html https://crbug.com/1432603 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42 https://lists.fedoraproject.org/archives/list/package-announce@l • CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 6CVE-2023-30547 – Sandbox Escape in vm2
https://notcve.org/view.php?id=CVE-2023-30547
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. ... A flaw was found in the vm2 sandbox. ... This issue may allow an attacker to bypass the sandbox protections, which can lead to remote code execution on the hypervisor host or the host that is running the sandbox. • https://github.com/rvizx/CVE-2023-30547 https://github.com/Cur1iosity/CVE-2023-30547 https://github.com/user0x1337/CVE-2023-30547 https://github.com/junnythemarksman/CVE-2023-30547 https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244 https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049 https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5 https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m https://access.redhat.com/security/cve&# • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-755: Improper Handling of Exceptional Conditions •