CVSS: 6.9EPSS: 1%CPEs: 1EXPL: 0CVE-2015-2489 – Microsoft Internet Explorer ISettingsBroker Sandbox Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2015-2489
Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Elevation of Privilege Vulnerability." Vulnerabilidad en Microsoft Internet Explorer 11, permite a atacantes remotos obtener privilegios a través de un sitio web manipulado, según lo demostrado por una transición desde Low Integrity hasta Medium Integrity, también conocida como 'Elevation of Privilege Vulnerability.' This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the usage of ISettingsBroker. By using a specified CLSID to the setValue method, an attacker can modify privileged registry values. • http://www.securityfocus.com/bid/76585 http://www.securitytracker.com/id/1033487 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-094 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-3793
https://notcve.org/view.php?id=CVE-2015-3793
CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app. Vulnerabilidad en CFPreferences en Apple iOS en versiones anteriores a 8.4.1, permite a atacantes eludir el mecanismo de protección de la aplicación sandbox de un tercero y leer preferencias gestionadas arbitrariamente a través de una aplicación manipulada. • http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html http://www.securityfocus.com/bid/76337 http://www.securitytracker.com/id/1033275 https://support.apple.com/kb/HT205030 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5749
https://notcve.org/view.php?id=CVE-2015-5749
The Sandbox_profiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app. Vulnerabilidad en el componente Sandbox_profiles en Apple iOS en versiones anteriores a 8.4.1, permite a atacantes eludir el mecanismo de protección de la aplicación sandbox de un tercero y leer preferencias gestionadas arbitrariamente a través de una aplicación manipulada. • http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html http://www.securityfocus.com/bid/76337 http://www.securitytracker.com/id/1033275 https://support.apple.com/kb/HT205030 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 11EXPL: 0CVE-2015-2429 – Microsoft Internet Explorer CIERegistryHelper::SetSingleValue Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2015-2429
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified registry actions via a crafted application, aka "Windows Registry Elevation of Privilege Vulnerability." Vulnerabilidad en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2 y Windows RT Gold y 8.1, permite a atacantes evadir el mecanismo de protección de una aplicación sandbox y realizar acciones de registro no especificados a a través de una aplicación manipulada, también conocida como 'Windows Registry Elevation of Privilege Vulnerability.' • http://www.securitytracker.com/id/1033251 http://www.zerodayinitiative.com/advisories/ZDI-15-379 http://www.zerodayinitiative.com/advisories/ZDI-15-380 http://www.zerodayinitiative.com/advisories/ZDI-15-459 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-090 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 11EXPL: 0CVE-2015-2430 – Microsoft Internet Explorer Filesystem Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2015-2430
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application, aka "Windows Filesystem Elevation of Privilege Vulnerability." Vulnerabilidad en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2 y Windows RT Gold y 8.1, permite a atacantes evadir el mecanismo de protección de una aplicación sandbox y realizar acciones del sistema de archivos no especificadas a través de una aplicación manipulada, también conocida como 'Windows Filesystem Elevation of Privilege Vulnerability.' • http://www.securityfocus.com/bid/76233 http://www.securitytracker.com/id/1033251 http://www.zerodayinitiative.com/advisories/ZDI-15-378 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-090 • CWE-264: Permissions, Privileges, and Access Controls •