CVSS: 4.7EPSS: 0%CPEs: 90EXPL: 1CVE-2022-29587 – Konica Minolta bizhub MFP Printer Terminal Sandbox Escape
https://notcve.org/view.php?id=CVE-2022-29587
Los dispositivos bizhub MFP de Konica Minolta versiones anteriores a 14-04-2022, presentan un navegador interno Chromium que es ejecutado con privilegios de acceso root (también se conoce como super usuario) Multiple Konica Minolta bizhub MFP printer terminals suffer from a sandbox escape with root access and have clear-text password vulnerabilities. • https://sec-consult.com/vulnerability-lab https://sec-consult.com/vulnerability-lab/advisory/sandbox-escape-with-root-access-clear-text-passwords-in-konica-minolta-bizhub-mfp-printer-terminals • CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 90EXPL: 0CVE-2022-29588 – Konica Minolta bizhub MFP Printer Terminal Sandbox Escape
https://notcve.org/view.php?id=CVE-2022-29588
Los dispositivos bizhub MFP de Konica Minolta versiones anteriores a 14-04-2022, usan el almacenamiento de contraseñas en texto sin cifrar para los archivos /var/log/nginx/html/ADMINPASS y /etc/shadow Multiple Konica Minolta bizhub MFP printer terminals suffer from a sandbox escape with root access and have clear-text password vulnerabilities. • http://packetstormsecurity.com/files/167166/Konica-Minolta-bizhub-MFP-Printer-Terminal-Sandbox-Escape.html https://sec-consult.com/vulnerability-lab • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-29911 – Mozilla: iframe Sandbox bypass
https://notcve.org/view.php?id=CVE-2022-29911
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. ... Una implementación incorrecta de la nueva palabra clave de iframe sandbox <code>allow-top-navigation-by-user-activation</code> podría provocar la ejecución del script sin que <code>allow-scripts</code> esté presente. ... The Mozilla Foundation Security Advisory describes the issue of Firefox not protecting against top-level navigations for an iframe sandbox with a policy relaxed through a keyword likely to allow top-navigation-by-user-activation. • https://bugzilla.mozilla.org/show_bug.cgi?id=1761981 https://www.mozilla.org/security/advisories/mfsa2022-16 https://www.mozilla.org/security/advisories/mfsa2022-17 https://www.mozilla.org/security/advisories/mfsa2022-18 https://access.redhat.com/security/cve/CVE-2022-29911 https://bugzilla.redhat.com/show_bug.cgi?id=2081471 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-23923 – Sandbox Bypass
https://notcve.org/view.php?id=CVE-2022-23923
All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. ... Todas las versiones del paquete jailed son vulnerables a una omisión de Sandbox por medio de un método exportado alert() que puede acceder a la aplicación principal. • https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2441254 https://snyk.io/vuln/SNYK-JS-JAILED-2391490 •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1309
https://notcve.org/view.php?id=CVE-2022-1309
Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Una aplicación insuficiente de políticas en developer tools de Google Chrome versiones anteriores a 100.0.4896.88, permitía a un atacante remoto llevar a cabo un filtrado de sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html https://crbug.com/1106456 https://security.gentoo.org/glsa/202208-25 • CWE-863: Incorrect Authorization •