CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2014-4423
https://notcve.org/view.php?id=CVE-2014-4423
The Accounts subsystem in Apple iOS before 8 allows attackers to bypass a sandbox protection mechanism and obtain an active iCloud account's Apple ID and metadata via a crafted application. El subsistema cuentas en Apple iOS anteriores a 8 permite a atacantes eludir el mecanismo de protección de sandbox y obtener el Apple ID y los metadatos de una cuenta activa de iCloud a través de una aplicación manipulada. • http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html http://support.apple.com/kb/HT6441 http://www.securityfocus.com/bid/69882 http://www.securityfocus.com/bid/69917 http://www.securitytracker.com/id/1030866 https://exchange.xforce.ibmcloud.com/vulnerabilities/96099 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 54EXPL: 0CVE-2014-0568
https://notcve.org/view.php?id=CVE-2014-0568
The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction attack. La funcionalidad de acople a llamada de sistema NtSetInformationFile en Adobe Reader y Acrobat 10.x en versiones anteriores a 10.1.12 y 11.x en versiones anteriores a 11.0.09 en Windows permite a atacantes eludir un mecanismo de protección de sandbox y consecuentemente ejecutar código nativo en un contexto privilegiado, a través de un ataque de unión NTFS. • http://helpx.adobe.com/security/products/reader/apsb14-20.html http://www.securityfocus.com/bid/69828 http://www.securitytracker.com/id/1030853 https://code.google.com/p/google-security-research/issues/detail?id=94 https://exchange.xforce.ibmcloud.com/vulnerabilities/96000 •
CVSS: 6.8EPSS: 1%CPEs: 72EXPL: 0CVE-2012-5485 – (Plone): Restricted Python injection
https://notcve.org/view.php?id=CVE-2012-5485
A remote attacker could use this flaw to inject a specially crafted Python statement or script into Plone's restricted Python sandbox that, when the administrator interface was accessed, would be executed with the privileges of that administrator user. • http://rhn.redhat.com/errata/RHSA-2014-1194.html http://www.openwall.com/lists/oss-security/2012/11/10/1 https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt https://plone.org/products/plone-hotfix/releases/20121106 https://plone.org/products/plone/security/advisories/20121106/01 https://access.redhat.com/security/cve/CVE-2012-5485 https://bugzilla.redhat.com/show_bug.cgi?id=878934 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-306: Missing Authentication for Critical Function •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2014-5206
https://notcve.org/view.php?id=CVE-2014-5206
The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allows local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a "mount -o remount" command within a user namespace. La función do_remount en fs/namespace.c en el kernel de Linux hasta 3.16.1 no mantiene el bit MNT_LOCK_READONLY durante el remontaje de un montaje bind, lo que permite a usuarios locales evadir las restricciones de sólo lectura y vencer ciertos mecanismos de protección sandbox a través de un comando 'mount -o remount' dentro de un espacio para el nombre del usuario. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a6138db815df5ee542d848318e5dae681590fccd http://www.openwall.com/lists/oss-security/2014/08/13/4 http://www.securityfocus.com/bid/69214 http://www.ubuntu.com/usn/USN-2317-1 http://www.ubuntu.com/usn/USN-2318-1 https://bugzilla.redhat.com/show_bug.cgi?id=1129662 https://github.com/torvalds/linux/commit/a6138db815df5ee542d848318e5dae681590fccd • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2014-0546 – Adobe Acrobat and Reader Sandbox Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2014-0546
Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors. Adobe Reader y Acrobat 10.x anterior a 10.1.11 y 11.x anterior a 11.0.08 en Windows permiten a atacantes evadir un mecanismo de protección sandbox, y como consecuencia ejecutar código nativo en un contexto privilegiado, a través de vectores no especificados. Adobe Acrobat and Reader on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context. • http://helpx.adobe.com/security/products/reader/apsb14-19.html http://www.securitytracker.com/id/1030711 •