CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2018-18505 – Mozilla: Privilege escalation through IPC channel messages
https://notcve.org/view.php?id=CVE-2018-18505
This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. ... Esto podría permitir un escape del sandbox a través de canales IPC debido a la falta de la validación de mensajes en el proceso en escucha. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html http://www.securityfocus.com/bid/106781 https://access.redhat.com/errata/RHSA-2019:0218 https://access.redhat.com/errata/RHSA-2019:0219 https://access.redhat.com/errata/RHSA-2019:0269 https://access.redhat.com/errata/RHSA-2019:0270 https://bugzilla.mozilla.org/show_bug.cgi?id=1087565 https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html https://lists.debian.org/debian-lts-announce/2019/02&# • CWE-287: Improper Authentication •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 1CVE-2019-6214 – macOS < 10.14.3 / iOS < 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem
https://notcve.org/view.php?id=CVE-2019-6214
A malicious application may be able to break out of its sandbox. ... Una aplicación maliciosa podría ser capaz de escapar del sandbox. iOS and MacOS suffers from sandbox escape vulnerabilities due to type confusions and memory safety issues in iohideventsystem. • https://www.exploit-db.com/exploits/46298 http://www.securityfocus.com/bid/106739 https://support.apple.com/HT209443 https://support.apple.com/HT209446 https://support.apple.com/HT209447 https://support.apple.com/HT209448 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 83%CPEs: 2EXPL: 5CVE-2019-1003000 – Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-1003000
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM. Existe una vulnerabilidad de omisión de sandbox en Script Security Plugin versión 1.49 y anteriores, en src/main/java/org/jenkinsc/plugins/scriptsecurity/sandbox/ groovy/GroovySandbox.java que permite a los atacantes la capacidad de proporcionar scripts de tipo Sandbox para ejecutar código arbitrario en el Jenkins master JVM. • https://www.exploit-db.com/exploits/46572 https://www.exploit-db.com/exploits/46453 https://www.exploit-db.com/exploits/46427 https://github.com/slowmistio/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming https://access.redhat.com/errata/RHBA-2019:0326 https://access.redhat.com/errata/RHBA-2019:0327 ht •
CVSS: 8.8EPSS: 32%CPEs: 2EXPL: 3CVE-2019-1003001 – Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-1003001
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Existe una vulnerabilidad de omisión de sandbox en Pipeline: el plugin Groovy, en la versión 2.61 y anteriores, en src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java y src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java permite a los atacantes con permisos de "Overall/Read" proporcionar un script "pipeline" a un endpoint HTTP que puede resultar en la ejecución de código arbitrario enla máquina virtual de Java maestra de Jenkins. • https://www.exploit-db.com/exploits/46572 https://www.exploit-db.com/exploits/46427 http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming https://access.redhat.com/errata/RHBA-2019:0326 https://access.redhat.com/errata/RHBA-2019:0327 https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 https://jenkins.io/security/advisory/2019-01-08 https://blog. •
CVSS: 8.8EPSS: 32%CPEs: 2EXPL: 3CVE-2019-1003002 – Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-1003002
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Existe una vulnerabilidad de omisión de sandbox en Pipeline: el plugin Declarative, en la versión 1.3.3 y anteriores, en pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy permite a los atacantes con permisos de "Overall/Read" proporcionar un script "pipeline" a un endpoint HTTP que puede resultar en la ejecución de código arbitrario en la máquina virtual de Java maestra de Jenkins. • https://www.exploit-db.com/exploits/46572 https://www.exploit-db.com/exploits/46427 http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming https://access.redhat.com/errata/RHBA-2019:0326 https://access.redhat.com/errata/RHBA-2019:0327 https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 https://jenkins.io/security/advisory/2019-01-08 https://blog. •