CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1312
https://notcve.org/view.php?id=CVE-2022-1312
Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. Un uso de memoria previamente liberada en storage en Google Chrome versiones anteriores a 100.0.4896.88, permitía a un atacante que convencía a un usuario para que instalara una extensión maliciosa llevar a cabo un filtrado de sandbox por medio de una extensión de Chrome diseñada • https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html https://crbug.com/1311701 https://security.gentoo.org/glsa/202208-25 • CWE-416: Use After Free •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1309
https://notcve.org/view.php?id=CVE-2022-1309
Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Una aplicación insuficiente de políticas en developer tools de Google Chrome versiones anteriores a 100.0.4896.88, permitía a un atacante remoto llevar a cabo un filtrado de sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html https://crbug.com/1106456 https://security.gentoo.org/glsa/202208-25 • CWE-863: Incorrect Authorization •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 1CVE-2021-42324
https://notcve.org/view.php?id=CVE-2021-42324
Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. ... Debido a una inapropiada comprobación de parámetros en la interfaz de la consola, es posible que un atacante autenticado con pocos privilegios escape del entorno del sandbox y ejecute comandos del sistema como root por medio de meta caracteres de shell en los parámetros de los comandos de captura. • https://exatel.pl/cve-2021-42324-metacharacter-injection-w-przelacznikach-dcn-s4600-10p-si https://www.dcneurope.eu/products/switches/s4600-10p-si • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-0790
https://notcve.org/view.php?id=CVE-2022-0790
Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially perform a sandbox escape via a crafted HTML page. Un uso de memoria previamente liberada en Cast UI en Google Chrome versiones anteriores a 99.0.4844.51, permitía a un atacante remoto que convenciera a un usuario de participar en una interacción específica con el usuario llevar a cabo potencialmente un filtrado del sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html https://crbug.com/1274077 https://security.gentoo.org/glsa/202208-25 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24783 – Sandbox bypass leading to arbitrary code execution in Deno
https://notcve.org/view.php?id=CVE-2022-24783
Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. • https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •