CVE-2025-6384

CVE-2025-6384: Contournement du sandbox Groovy 2 dans CrafterCMS Vulnérabilité de contrôle inadéquat des ressources de code gérées dynamiquement dans Crafter Studio de Crafter CMS permet aux développeurs authentifiés d'exécuter des commandes OS via un contournement du sandbox Groovy. Divulgation ...

CVE-2022-40635

CVE-2022-40635 : Contournement du bac à sable Groovy dans CrafterCMS Vulnérabilité de contrôle inadéquat des ressources de code gérées dynamiquement dans Crafter Studio de Crafter CMS permet aux développeurs authentifiés d'exécuter des commandes système via un contournement du bac à sable Groovy...

jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25

إضافة Script Security دليل المستخدم مقتبس من معلومات حول دليل إضافة Template في دليل إضافات CloudBees تتطلب العديد من إضافات Jenkins من المستخدمين تعريف سكربتات مخصصة، غالبًا بلغة Groovy، لتخصيص سلوك Jenkins. إذا كان كل من يكتب هذه السكربتات مسؤولًا عن Jenkins— وتحديدًا إذا كان لديهم صلاحية...

Groovy-scripting-engine-CVE-2015-1427

Ambiente de teste do bypass do sandbox Groovy do ElasticSearch && da vulnerabilidade de execução de código CVE-2015-1427 Versão do jre: openjdk:8-jre Versão do elasticsearch: v1.4.2 Princípio Referências: http://cb.drops.wiki/drops/papers-5107.html...

CVE-2025-31722

CVE-2025-31722 — Jenkins Templating Engine RCE Nur für Bildungszwecke und autorisierte Sicherheitsforschung. Beschreibung Sandbox-Bypass-Sicherheitslücke im Jenkins Templating Engine JTE Plugin = 2.5.3, die es einem Benutzer mit niedrigen Berechtigungen ermöglicht, beliebigen Code auf dem...

exploit-CVE-2015-1427

Elasticsearch 1.4.0 1.4.2 Esecuzione di codice remoto Elasticsearch è un motore di ricerca e analisi distribuito e RESTful in grado di risolvere un numero crescente di casi d'uso. Come cuore dello Elastic Stack, memorizza centralmente i tuoi dati così da poter scoprire l'atteso e rivelare...

CrafterCMS-CVE-2025-6384

CrafterCMS प्रमाणित RCE - Groovy सैंडबॉक्स बाईपास CVE-2025-6384 CrafterCMS में प्रमाणित रिमोट कोड एक्ज़ीक्यूशन भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट। भेद्यता सारांश डेवलपर विशेषाधिकारों वाला एक प्रमाणित उपयोगकर्ता रिमोट कोड एक्ज़ीक्यूशन RCE प्राप्त करने के लिए Crafter Studio में Groovy स्क्रिप्ट...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30665)

Apache Syncope is an open-source digital identity management system, primarily used for authentication, authorization, and account management. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from insufficient protection of the Groovy security sandbox, which leads ...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30660)

Apache Syncope is an open-source identity management platform, primarily used for user authentication, authorization, and account management in enterprise environments. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from a bypass of the Groovy security sandbox...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-53421

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' REST and SQL capability to run Groovy scripts. This issue affects Apache...

CVE-2026-53421 Apache Syncope: Remote Code Execution via Scripted Connector

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' REST and SQL capability to run Groovy scripts. This issue affects Apache...

CVE-2026-53421

CVE-2026-53421 affects Apache Syncope: remote code execution is possible by an administrator with adequate entitlements through the connector subsystem via scripted Groovy scripts (REST/SQL) in connectors. Affected versions: 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, and 4.1.0-M0–4.1.1. The issue stems fro...

CVE-2026-53421 Apache Syncope: Remote Code Execution via Scripted Connector

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' REST and SQL capability to run Groovy scripts. This issue affects Apache...

CVE-2026-53421 Apache Syncope: Remote Code Execution via Scripted Connector

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' REST and SQL capability to run Groovy scripts. This issue affects Apache...

CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-63071

Apache Syncope suffers an RCE via Groovy Sandbox bypass (Improper Isolation). A privileged user can craft a malicious Groovy class that executes untrusted code, bypassing the Groovy sandbox. Affected versions: 3.0.0-M0–3.0.16; 4.0.0-M0–4.0.6; 4.1.0-M0–4.1.1. Fixes are available in versions 4.0.7 ...

EUVD-2026-45955

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...