CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-0461
https://notcve.org/view.php?id=CVE-2022-0461
Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page. Una omisión de políticas en COOP en Google Chrome versiones anteriores a 98.0.4758.80, permitía a un atacante remoto omitir el sandbox de iframe por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html https://crbug.com/1256823 •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-0466
https://notcve.org/view.php?id=CVE-2022-0466
Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page. Una implementación inapropiada de Extensions Platform en Google Chrome versiones anteriores a 98.0.4758.80, permitía que un atacante que convenciera a un usuario de instalar una extensión maliciosa potencialmente llevar a cabo un filtrado de sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html https://crbug.com/1115460 •
CVSS: 10.0EPSS: 97%CPEs: 6EXPL: 4CVE-2022-0543 – Debian-specific Redis Server Lua Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2022-0543
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. Se ha detectado que redis, una base de datos persistente de valores clave, debido a un problema de empaquetado, es propenso a un escape del sandbox de Lua (específico de Debian), que podría resultar en una ejecución de código remota Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. • https://github.com/0x7eTeam/CVE-2022-0543 https://github.com/z92g/CVE-2022-0543 https://github.com/JacobEbben/CVE-2022-0543 http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html https://bugs.debian.org/1005787 https://lists.debian.org/debian-security-announce/2022/msg00048.html https://security.netapp.com/advisory/ntap-20220331-0004 https://www.debian.org/security/2022/dsa-5081 https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce • CWE-862: Missing Authorization •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42952
https://notcve.org/view.php?id=CVE-2021-42952
Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services. Todas las versiones anteriores al 25 de octubre de 2021 de Zepl Notebooks están afectadas por una vulnerabilidad de escape de sandbox. Al iniciar una ejecución de código remota desde el cuaderno, los usuarios pueden usarlo para escapar posteriormente del sandbox del contexto en ejecución y proceder a acceder a activos internos de Zepl, incluidos servicios de metadatos en la nube. • http://zepl.com https://seclists.org/fulldisclosure/2022/Feb/32 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25183 – workflow-cps-global-lib: Sandbox bypass vulnerability
https://notcve.org/view.php?id=CVE-2022-25183
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists. Jenkins Pipeline: Shared Groovy Libraries Plugin versiones 552.vd9cc05b8a2e1 y anteriores, usan los nombres de las bibliotecas de Pipeline para crear directorios de caché sin ningún tipo de saneo, lo que permite a atacantes con permiso de Item/Configure ejecutar código arbitrario en el contexto de la JVM del controlador de Jenkins usando nombres de bibliotecas especialmente diseñados si ya se presenta una biblioteca global de Pipeline configurada para usar la caché A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries plugin uses the names of Pipeline libraries to create cache directories without any sanitization. This flaw allows attackers with item/configure permission to execute arbitrary code in the context of the Jenkins controller JVM, using specially crafted library names if a global Pipeline library configured to use caching already exists. • https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2586 https://access.redhat.com/security/cve/CVE-2022-25183 https://bugzilla.redhat.com/show_bug.cgi?id=2055802 • CWE-179: Incorrect Behavior Order: Early Validation •