Page 14 of 419 results (0.132 seconds)

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0

This vulnerability allows remote attackers to escape the sandbox on affected installations of Adobe Acrobat Reader DC. ... An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current process. • https://helpx.adobe.com/security/products/acrobat/apsb23-24.html • CWE-20: Improper Input Validation •

CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 8

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. • https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cce https://github.com/hacksparrow/safe-eval/issues/27 https://github.com/hacksparrow/safe-eval/issues/31 https://github.com/hacksparrow/safe-eval/issues/32 https://github.com/hacksparrow/safe-eval/issues/33 https://github.com/hacksparrow/safe-eval/issues/34 https://github.com/hacksparrow/safe-eval/issues/35 https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064 • CWE-265: Privilege Issues CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •

CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1

delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. • https://github.com/javadelight/delight-nashorn-sandbox/issues/135 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 4

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. ... A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. ... This flaw allows a remote, unauthenticated attacker to escape the restrictions of the sandbox and execute code on the host. • https://github.com/timb-machine-mirrors/seongil-wi-CVE-2023-29017 https://github.com/passwa11/CVE-2023-29017-reverse-shell https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50 https://github.com/patriksimek/vm2/issues/515 https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv https://access.redhat.com/security/cve/CVE-2023-29017 https://bugzilla.redhat.com/show_bug.cgi?id=2185374 • CWE-755: Improper Handling of Exceptional Conditions CWE-913: Improper Control of Dynamically-Managed Code Resources •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. • https://github.com/dievus/CVE-2022-27665 https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 https://docs.ipswitch.com/WS_FTP_Server2020/ReleaseNotes/index.htm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •