PT-2023-12047 · Odoo · Odoo Community +1

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier Description: A sandboxing issue allows authenticated administrators to access and modify database contents of other tenants in a multi-tenant system...

PT-2023-12043 · Odoo · Odoo Community +1

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier Description: A sandboxing issue allows authenticated administrators to read and write local files on the server. Recommendations: For Odoo Community versions...

PT-2023-12548 · Odoo · Odoo Community +1

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier Description: A sandboxing issue allows authenticated administrators to read local files on the server, including sensitive configuration files. Recommendations...

iOS Lockdown Mode effective against NSO zero-click exploit

Apples Lockdown Mode feature alerted a victim to one of the latest NSO exploits, according to a report by Citizen Lab. image courtesy of Citizen Lab This is a huge deal since it shows how useful Lockdown Mode can be, even against exploits developed by one of the worlds most notorious commercial...

CVE-2020-29007

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles potentially including unauthenticated anonymous users to execute arbitrary Scheme or shell cod...

Remote code execution

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles potentially including unauthenticated anonymous users to execute arbitrary Scheme or shell cod...

CVE-2020-29007

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles potentially including unauthenticated anonymous users to execute arbitrary Scheme or shell cod...

CVE-2020-29007

The CVE-2020-29007 entry concerns MediaWiki’s Score extension up to version 0.3.0, where the vulnerability arises from improper sandboxing of the GNU LilyPond executable. This allows any user with article-edit capability—potentially unauthenticated users—to trigger remote code execution by crafti...

CVE-2020-29007

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles potentially including unauthenticated anonymous users to execute arbitrary Scheme or shell cod...

CVE-2022-48432

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...

Design/Logic Flaw

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...

CVE-2022-48432

The CVE-2022-48432 issue affects JetBrains IntelliJ IDEA prior to 2023.1, where the bundled Chromium was not sandboxed. This vulnerability is described across multiple sources as a sandboxing weakness in the Chromium component integrated with IntelliJ IDEA, with potential impact to confidentialit...

CVE-2022-48432

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...

CVE-2022-48432

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...

PT-2023-15776 · Jetbrains · Jetbrains Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2023.1 Description: The issue concerns the bundled version of Chromium in JetBrains IntelliJ IDEA, which was not sandboxed. This lack of sandboxing could potentially lead to security issues...

CVE-2023-28439

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages ...

CVE-2023-28100

CVE-2023-28100 affects Flatpak on Linux prior to versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. The root cause involves using the TIOCLINUX ioctl on Linux virtual consoles (e.g., /dev/tty1) which can allow a Flatpak app running in a console to copy text from the console into the command buffer and ...

Nautobot vulnerable to remote code execution via Jinja2 template rendering

Impact What kind of vulnerability is it? Who is impacted? All users of Nautobot versions earlier than 1.5.7 are impacted. In Nautobot 1.5.7 we have enabled sandboxed environments for the Jinja2 template engine used internally for template rendering for the following objects: - extras.ComputedFiel...

How to Detect New Threats via Suspicious Activities

Unknown malware presents a significant cybersecurity threat and can cause serious damage to organizations and individuals alike. When left undetected, malicious code can gain access to confidential information, corrupt data, and allow attackers to gain control of systems. Find out how to avoid...

CVE-2023-26081

CVE-2023-26081 affects Epiphany (GNOME Web) up to version 43.0, where autofill can exfiltrate passwords from sandboxed content (e.g., CSP sandbox or iframe). Exploitation would require untrusted web content, but attackers could leverage sandbox context to access credentials. Remediation across di...