CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2024-2839 – Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-2839
01 Apr 2024 — El complemento Colibri Page Builder de WordPress es vulnerable a cross-site scripting almacenado a través del código corto 'colibri_post_title' del complemento en todas las versiones hasta la 1.0.263 incluida debido a una desinfección de entrada y a un escape de salida en atributos proporcionados por el usuario como 'heading_type' insuficientes. • https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 32EXPL: 0CVE-2024-29944 – Mozilla Firefox Exposed Dangerous Function Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2024-29944
22 Mar 2024 — This vulnerability allows remote attackers to escape the sandbox on affected installations of Mozilla Firefox. ... An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current user at medium integrity. • http://www.openwall.com/lists/oss-security/2024/03/23/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-830: Inclusion of Web Functionality from an Untrusted Source •
CVSS: 9.0EPSS: 57%CPEs: 1EXPL: 5CVE-2024-28116 – Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
https://notcve.org/view.php?id=CVE-2024-28116
21 Mar 2024 — Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. • https://packetstorm.news/files/id/182033 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-27297 – Nix Corruption of fixed-output derivations
https://notcve.org/view.php?id=CVE-2024-27297
11 Mar 2024 — It was discovered that insufficient restriction of unix daemon sockets in the GNU Guix functional package manager could result in sandbox bypass. • https://github.com/NixOS/nix/commit/f8170ce9f119e5e6724eb81ff1b5a2d4c0024000 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.9EPSS: 0%CPEs: 2EXPL: 0CVE-2024-22254 – Out-of-bounds write vulnerability
https://notcve.org/view.php?id=CVE-2024-22254
05 Mar 2024 — A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox. ... Un actor malicioso con privilegios dentro del proceso VMX puede desencadenar una escritura fuera de los límites que conduzca a un escape del entorno limitado. ... A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox. • https://www.vmware.com/security/advisories/VMSA-2024-0006.html • CWE-787: Out-of-bounds Write •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 2CVE-2024-23681 – Artemis Java Test Sandbox Libary Load Escape
https://notcve.org/view.php?id=CVE-2024-23681
19 Jan 2024 — Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. ... Las versiones de Artemis Java Test Sandbox anteriores a 1.11.2 son vulnerables a un escape de la sandbox cuando un atacante carga librerías que no son de confianza utilizando System.load o System.loadLibrary. • https://github.com/advisories/GHSA-98hq-4wmw-98w9 • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 2CVE-2024-23683 – Artemis Java Test Sandbox InvocationTargetException Subclass Escape
https://notcve.org/view.php?id=CVE-2024-23683
19 Jan 2024 — Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. ... Las versiones de Artemis Java Test Sandbox inferiores a 1.7.6 son vulnerables a un escape de la sandbox cuando un atacante crea una subclase especial de InvocationTargetException. • https://github.com/advisories/GHSA-883x-6fch-6wjx •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 2CVE-2024-23682 – Artemis Java Test Sandbox Class Loading Escape
https://notcve.org/view.php?id=CVE-2024-23682
19 Jan 2024 — Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. ... Las versiones de Artemis Java Test Sandbox anteriores a 1.8.0 son vulnerables a un escape de la sandbox cuando un atacante incluye archivos de clase en un paquete en el que Ares confía. • https://github.com/advisories/GHSA-227w-wv4j-67h4 • CWE-501: Trust Boundary Violation CWE-653: Improper Isolation or Compartmentalization •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6135 – nss: vulnerable to Minerva side-channel information leak
https://notcve.org/view.php?id=CVE-2023-6135
19 Dec 2023 — An attacker could potentially exploit this issue to escape the sandbox. • https://bugzilla.mozilla.org/show_bug.cgi?id=1853908 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 10.0EPSS: 1%CPEs: 6EXPL: 0CVE-2023-6864 – Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6
https://notcve.org/view.php?id=CVE-2023-6864
19 Dec 2023 — An attacker could potentially exploit this issue to escape the sandbox. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1736385%2C1810805%2C1846328%2C1856090%2C1858033%2C1858509%2C1862089%2C1862777%2C1864015 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •