CVSS: 5.3EPSS: 0%CPEs: 149EXPL: 0CVE-2024-20286 – Cisco NX-OS Software Python Parser Escape Vulnerability
https://notcve.org/view.php?id=CVE-2024-20286
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of user-supplied input. ... A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-psbe-ce-YvbTn5du https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/105x/programmability/cisco-nexus-9000-series-nx-os-programmability-guide-105x/m-n9k-python-api-101x.html?bookSearch=true#concept_A2CFF094ADCB414C983EA06AD8E9A410 • CWE-693: Protection Mechanism Failure •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-42472 – Flatpak may allow access to files outside sandbox for certain apps
https://notcve.org/view.php?id=CVE-2024-42472
A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the designated sandbox. • https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87 https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5 https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72 https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75 https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97 http • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-7519 – mozilla: Out of bounds memory access in graphics shared memory handling
https://notcve.org/view.php?id=CVE-2024-7519
This could be leveraged by an attacker to perform a sandbox escape. ... This could be leveraged by an attacker to perform a sandbox escape. ... This could be leveraged by an attacker to perform a sandbox escape. • https://bugzilla.mozilla.org/show_bug.cgi?id=1902307 https://www.mozilla.org/security/advisories/mfsa2024-33 https://www.mozilla.org/security/advisories/mfsa2024-34 https://www.mozilla.org/security/advisories/mfsa2024-35 https://www.mozilla.org/security/advisories/mfsa2024-37 https://www.mozilla.org/security/advisories/mfsa2024-38 https://access.redhat.com/security/cve/CVE-2024-7519 https://bugzilla.redhat.com/show_bug.cgi?id=2303136 • CWE-787: Out-of-bounds Write •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1724 – snapd allows $HOME/bin symlink
https://notcve.org/view.php?id=CVE-2024-1724
An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement. • https://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6 https://github.com/snapcore/snapd/pull/13689 https://gld.mcphail.uk/posts/explaining-cve-2024-1724 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7012
https://notcve.org/view.php?id=CVE-2023-7012
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. • https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html https://issues.chromium.org/issues/40061509 • CWE-20: Improper Input Validation CWE-138: Improper Neutralization of Special Elements •