CVSS: 9.3EPSS: 79%CPEs: 8EXPL: 2CVE-2014-0257 – Microsoft .NET Deployment Service - IE Sandbox Escape (MS14-009)
https://notcve.org/view.php?id=CVE-2014-0257
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability." Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5 y 4.5.1 no determina adecuadamente si es seguro ejecutar un método, lo que permite a atacantes remotos ejecutar código arbitrario a través de (1) un sitio web manipulado o (2) una aplicación .NET Framework manipulada que expone un servidor COM, también conocido como "Type Traversal Vulnerability." • https://www.exploit-db.com/exploits/33892 http://packetstormsecurity.com/files/127246/MS14-009-.NET-Deployment-Service-IE-Sandbox-Escape.html http://secunia.com/advisories/56793 http://www.exploit-db.com/exploits/33892 http://www.osvdb.org/103163 http://www.securityfocus.com/bid/65417 http://www.securitytracker.com/id/1029745 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009 https://github.com/tyranid/IE11SandboxEscapes • CWE-20: Improper Input Validation •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 3CVE-2013-5045 – Microsoft Registry Symlink - IE Sandbox Escape (MS13-097)
https://notcve.org/view.php?id=CVE-2013-5045
Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code, aka "Internet Explorer Elevation of Privilege Vulnerability." Microsoft Internet Explorer 10 y 11 permite a usuarios locales evadir el mecanismo de modo protegido, y consecuentemente obtener privilegios mediante el aprovechamiento de la capacidad de ejecutar código en una sandbox, también conocido como "Vulnerabilidad de elevación de privilegios en Internet Explorer". • https://www.exploit-db.com/exploits/33893 http://packetstormsecurity.com/files/127245/MS13-097-Registry-Symlink-IE-Sandbox-Escape.html http://www.exploit-db.com/exploits/33893 http://www.osvdb.org/100757 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-097 https://github.com/tyranid/IE11SandboxEscapes • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 4EXPL: 0CVE-2013-4041 – JDK: unspecified sandbox bypass (JVM)
https://notcve.org/view.php?id=CVE-2013-4041
Unspecified vulnerability in IBM Java SDK 5.0.0 before SR16 FP4, 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to access restricted classes via unspecified vectors. Vulnerabilidad no especificada en el Java SDK de IBM 5.0.0 anteriores a SR16 FP4, 7.0.0 anteriores a SR6, 6.0.1 anteriores a SR7, y 6.0.0 anteriores a SR15 permite a atacantes remotos acceder clases restringidas a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2013-1507.html http://rhn.redhat.com/errata/RHSA-2013-1508.html http://rhn.redhat.com/errata/RHSA-2013-1509.html http://rhn.redhat.com/errata/RHSA-2013-1793.html http://secunia.com/advisories/56338 http://www-01.ibm.com/support/docview.wss?uid=swg1IV51087 http://www-01.ibm.com/support/docview.wss?uid=swg1IV51088 http://www-01.ibm.com/support/docview.wss?uid •
CVSS: 6.8EPSS: 1%CPEs: 4EXPL: 0CVE-2013-5375 – JDK: unspecified sandbox bypass (XML)
https://notcve.org/view.php?id=CVE-2013-5375
Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL. Vulnerabilidad no especificada en IBM Java SDK 7.0.0 anteriores a SR6, 6.0.1 anteriores a SR7, 6.0.0 anteriores a SR15, y 5.0.0 anteriores a SR16 FP4 permite a atacantes remotos acceder a clases restringidas a través de vectores no especificados relacionados con XML y XSL. • http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2013-1507.html http://rhn.redhat.com/errata/RHSA-2013-1508.html http://rhn.redhat.com/errata/RHSA-2013-1509.html http://rhn.redhat.com/errata/RHSA-2013-1793.html http://secunia.com/advisories/56338 http://www-01.ibm.com/support/docview.wss?uid=swg1IV51089 http://www-01.ibm.com/support/docview.wss?uid=swg1IV51090 http://www-01.ibm.com/support/docview.wss?uid •
CVSS: 9.3EPSS: 5%CPEs: 1EXPL: 0CVE-2013-5456 – JDK: unspecified sandbox bypass (ORB)
https://notcve.org/view.php?id=CVE-2013-5456
The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block. La clase com.ibm.rmi.io.SunSerializableFactory en IBM Java SDK 7.0.0 en versiones anteriores a SR6 permite a atacantes remotos eludir un mecanismo de protección de sandbox y ejecutar código arbitrario a través de vectores relacionados con deserialización dentro del bloque AccessController doPrivileged. • http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2013-1507.html http://secunia.com/advisories/56338 http://www-01.ibm.com/support/docview.wss?uid=swg1IV51329 http://www-01.ibm.com/support/docview.wss?uid=swg21655201 http://www-01.ibm.com/support/docview.wss?uid=swg21655202 http://www.security-explorations.com/materials/SE-2012-01-IBM-3.pdf http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf https:/& •