CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-26405 – ZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions Bypass
https://notcve.org/view.php?id=CVE-2023-26405
This vulnerability allows remote attackers to escape the sandbox on affected installations of Adobe Acrobat Reader DC. ... An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current process. • https://helpx.adobe.com/security/products/acrobat/apsb23-24.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 8CVE-2023-26122
https://notcve.org/view.php?id=CVE-2023-26122
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. • https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cce https://github.com/hacksparrow/safe-eval/issues/27 https://github.com/hacksparrow/safe-eval/issues/31 https://github.com/hacksparrow/safe-eval/issues/32 https://github.com/hacksparrow/safe-eval/issues/33 https://github.com/hacksparrow/safe-eval/issues/34 https://github.com/hacksparrow/safe-eval/issues/35 https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064 • CWE-265: Privilege Issues CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2023-26919
https://notcve.org/view.php?id=CVE-2023-26919
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. • https://github.com/javadelight/delight-nashorn-sandbox/issues/135 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 4CVE-2023-29017 – vm2 Sandbox Escape vulnerability
https://notcve.org/view.php?id=CVE-2023-29017
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. ... A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. ... This flaw allows a remote, unauthenticated attacker to escape the restrictions of the sandbox and execute code on the host. • https://github.com/timb-machine-mirrors/seongil-wi-CVE-2023-29017 https://github.com/passwa11/CVE-2023-29017-reverse-shell https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50 https://github.com/patriksimek/vm2/issues/515 https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv https://access.redhat.com/security/cve/CVE-2023-29017 https://bugzilla.redhat.com/show_bug.cgi?id=2185374 • CWE-755: Improper Handling of Exceptional Conditions CWE-913: Improper Control of Dynamically-Managed Code Resources •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-27665
https://notcve.org/view.php?id=CVE-2022-27665
Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. • https://github.com/dievus/CVE-2022-27665 https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 https://docs.ipswitch.com/WS_FTP_Server2020/ReleaseNotes/index.htm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •