CVE-2021-42952

Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services...

CVE-2021-42952

Affected product: Zepl Notebooks. The CVE-2021-42952 entry describes a sandbox-escape flaw that enables Remote Code Execution from a Notebook to escape the sandbox and access internal Zepl assets, including cloud metadata services, effectively compromising cloud assets. The vulnerability affects ...

GitLab: GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery

Summary The GitLab::UrlBlocker IP address validation methods suffer from a Time of Check to Time of Use ToCToU vulnerability. The vulnerability occurs due to multiple DNS resolution requests performed before and after the checks. This issue allows a malicious authenticated user to send GET and PO...