CVE-2025-31722

CVE-2025-31722 — Jenkins Templating Engine RCE Solo con fines educativos y de investigación de seguridad autorizada. Descripción Vulnerabilidad de bypass de sandbox en el plugin Jenkins Templating Engine JTE = 2.5.3 que permite a un usuario con pocos privilegios ejecutar código arbitrario en el...

Groovy-scripting-engine-CVE-2015-1427

Entorno de prueba de la omisión del sandbox de Groovy y ejecución de código en ElasticSearch CVE-2015-1427 Versión de JRE: openjdk:8-jre Versión de Elasticsearch: v1.4.2 Principio Artículos de referencia: http://cb.drops.wiki/drops/papers-5107.html...

jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25

Script Security Plugin Guía del usuario adaptado de la información sobre Template plugin en la guía de CloudBees Plugins Varios complementos de Jenkins requieren que los usuarios definan scripts personalizados, más comúnmente en el lenguaje Groovy, para personalizar el comportamiento de Jenkins. ...

exploit-CVE-2015-1427

Elasticsearch 1.4.0 1.4.2 Ejecución Remota de Código Elasticsearch es un motor de búsqueda y analítica distribuido, RESTful, capaz de resolver un número creciente de casos de uso. Como el corazón de Elastic Stack, almacena centralmente tus datos para que puedas descubrir lo esperado y revelar lo...

CVE-2025-6384

CVE-2025-6384: Groovy Sandbox Bypass 2 en CrafterCMS La vulnerabilidad de control inadecuado de recursos de código gestionados dinámicamente en Crafter Studio de Crafter CMS permite a desarrolladores autenticados ejecutar comandos del sistema operativo mediante Groovy Sandbox Bypass. Divulgación...

CVE-2022-40635

CVE-2022-40635: Omisión del Sandbox de Groovy en CrafterCMS Vulnerabilidad de Control Inadecuado de Recursos de Código Gestionado Dinámicamente en Crafter Studio de Crafter CMS que permite a desarrolladores autenticados ejecutar comandos del sistema operativo mediante la omisión del Sandbox de...

CrafterCMS-CVE-2025-6384

CrafterCMS Autenticado RCE - Bypass de Sandbox de Groovy CVE-2025-6384 Una Prueba de Concepto para una vulnerabilidad de Ejecución Remota de Código autenticada en CrafterCMS. Resumen de la Vulnerabilidad Un usuario autenticado con privilegios de desarrollador puede eludir el sandbox de scripts...

CVE-2026-47424 OpenAM Authenticated RCE via Groovy Sandbox Escape

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-77147

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

EUVD-2026-77457

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

CVE-2026-77147

Apache Syncope is vulnerable to an Improper Control of Generation of Code (Code Injection) vulnerability. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation , effectively ...

CVE-2026-77147: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30665)

Apache Syncope is an open-source digital identity management system, primarily used for authentication, authorization, and account management. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from insufficient protection of the Groovy security sandbox, which leads ...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30660)

Apache Syncope is an open-source identity management platform, primarily used for user authentication, authorization, and account management in enterprise environments. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from a bypass of the Groovy security sandbox...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization due to the GroovySandboxScriptEngineImpl implementation in the core/spring module. An administrator with the entitlements to manage Implementations can supply a malicious Groovy class that...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-53421

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' REST and SQL capability to run Groovy scripts. This issue affects Apache...

CVE-2026-53421

Apache Syncope is vulnerable to Remote Code Execution (RCE) due to an Improper Isolation or Compartmentalization flaw in the connector subsystem. The root cause is the insufficient protection of the Groovy security sandbox , which allows an administrator with adequate entitlements to execute mali...