CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2014-8778
https://notcve.org/view.php?id=CVE-2014-8778
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission. Vulnerabilidad en Checkmarx CxSAST (anteriormente CxSuite) en versiones anteriores a 7.1.8, permite a usuarios remotos autenticados eludir el mecanismo de protección sandbox CxQL y ejecutar código arbitrario C# afirmando el permiso (1) System.Security.Permissions.PermissionState.Unrestricted o (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags. • http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html http://seclists.org/fulldisclosure/2015/Sep/17 http://www.securityfocus.com/archive/1/536387/100/0/threaded • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.9EPSS: 1%CPEs: 1EXPL: 0CVE-2015-2489 – Microsoft Internet Explorer ISettingsBroker Sandbox Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2015-2489
Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Elevation of Privilege Vulnerability." Vulnerabilidad en Microsoft Internet Explorer 11, permite a atacantes remotos obtener privilegios a través de un sitio web manipulado, según lo demostrado por una transición desde Low Integrity hasta Medium Integrity, también conocida como 'Elevation of Privilege Vulnerability.' This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the usage of ISettingsBroker. By using a specified CLSID to the setValue method, an attacker can modify privileged registry values. • http://www.securityfocus.com/bid/76585 http://www.securitytracker.com/id/1033487 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-094 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 11EXPL: 0CVE-2015-2429 – Microsoft Internet Explorer CIERegistryHelper::SetSingleValue Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2015-2429
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified registry actions via a crafted application, aka "Windows Registry Elevation of Privilege Vulnerability." Vulnerabilidad en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2 y Windows RT Gold y 8.1, permite a atacantes evadir el mecanismo de protección de una aplicación sandbox y realizar acciones de registro no especificados a a través de una aplicación manipulada, también conocida como 'Windows Registry Elevation of Privilege Vulnerability.' • http://www.securitytracker.com/id/1033251 http://www.zerodayinitiative.com/advisories/ZDI-15-379 http://www.zerodayinitiative.com/advisories/ZDI-15-380 http://www.zerodayinitiative.com/advisories/ZDI-15-459 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-090 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.4EPSS: 0%CPEs: 11EXPL: 0CVE-2015-2454 – Microsoft Internet Explorer HelpPane Sandbox Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2015-2454
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows KMD Security Feature Bypass Vulnerability." Vulnerabilidad en el controlador del modo kernel en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2 y Windows RT Gold y 8.1, no restringe adecuadamente los niveles de suplantación, lo que permite a usuarios locales obtener privilegios a través de una aplicación manipulada, también conocida como 'Windows KMD Security Feature Bypass Vulnerability'. • http://www.securitytracker.com/id/1033238 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 11EXPL: 0CVE-2015-2430 – Microsoft Internet Explorer Filesystem Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2015-2430
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application, aka "Windows Filesystem Elevation of Privilege Vulnerability." Vulnerabilidad en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2 y Windows RT Gold y 8.1, permite a atacantes evadir el mecanismo de protección de una aplicación sandbox y realizar acciones del sistema de archivos no especificadas a través de una aplicación manipulada, también conocida como 'Windows Filesystem Elevation of Privilege Vulnerability.' • http://www.securityfocus.com/bid/76233 http://www.securitytracker.com/id/1033251 http://www.zerodayinitiative.com/advisories/ZDI-15-378 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-090 • CWE-264: Permissions, Privileges, and Access Controls •