CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2024-28116 – Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
https://notcve.org/view.php?id=CVE-2024-28116
Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. • https://github.com/geniuszlyy/GenGravSSTIExploit https://github.com/akabe1/Graver https://github.com/getgrav/grav/commit/4149c81339274130742831422de2685f298f3a6e https://github.com/getgrav/grav/security/advisories/GHSA-c9gp-64c4-2rrh • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27102 – Improper isolation of server file access in github.com/pterodactyl/wings
https://notcve.org/view.php?id=CVE-2024-27102
The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible. • https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287 https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-363: Race Condition Enabling Link Following •
CVSS: 8.8EPSS: 85%CPEs: 2EXPL: 0CVE-2023-50386 – Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
https://notcve.org/view.php?id=CVE-2023-50386
Execution can further bypass the Java sandbox configured by Solr, ultimately causing arbitrary command execution. • http://www.openwall.com/lists/oss-security/2024/02/09/1 https://solr.apache.org/security.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets • CWE-434: Unrestricted Upload of File with Dangerous Type CWE-913: Improper Control of Dynamically-Managed Code Resources •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 2CVE-2024-23681 – Artemis Java Test Sandbox Libary Load Escape
https://notcve.org/view.php?id=CVE-2024-23681
Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. ... Las versiones de Artemis Java Test Sandbox anteriores a 1.11.2 son vulnerables a un escape de la sandbox cuando un atacante carga librerías que no son de confianza utilizando System.load o System.loadLibrary. • https://github.com/advisories/GHSA-98hq-4wmw-98w9 https://github.com/ls1intum/Ares/security/advisories/GHSA-98hq-4wmw-98w9 https://vulncheck.com/advisories/vc-advisory-GHSA-98hq-4wmw-98w9 • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 2CVE-2024-23683 – Artemis Java Test Sandbox InvocationTargetException Subclass Escape
https://notcve.org/view.php?id=CVE-2024-23683
Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. ... Las versiones de Artemis Java Test Sandbox inferiores a 1.7.6 son vulnerables a un escape de la sandbox cuando un atacante crea una subclase especial de InvocationTargetException. • https://github.com/advisories/GHSA-883x-6fch-6wjx https://github.com/ls1intum/Ares/commit/af4f28a56e2fe600d8750b3b415352a0a3217392 https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371 https://github.com/ls1intum/Ares/releases/tag/1.7.6 https://github.com/ls1intum/Ares/security/advisories/GHSA-883x-6fch-6wjx https://vulncheck.com/advisories/vc-advisory-GHSA-883x-6fch-6wjx •