986 matches found
CVE-2020-29007
The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles potentially including unauthenticated anonymous users to execute arbitrary Scheme or shell cod...
CVE-2020-29007
The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles potentially including unauthenticated anonymous users to execute arbitrary Scheme or shell cod...
CVE-2022-48432
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...
Design/Logic Flaw
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...
CVE-2022-48432
The CVE-2022-48432 issue affects JetBrains IntelliJ IDEA prior to 2023.1, where the bundled Chromium was not sandboxed. This vulnerability is described across multiple sources as a sandboxing weakness in the Chromium component integrated with IntelliJ IDEA, with potential impact to confidentialit...
CVE-2022-48432
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...
CVE-2022-48432
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed...
PT-2023-15776 · Jetbrains · Jetbrains Intellij Idea
Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2023.1 Description: The issue concerns the bundled version of Chromium in JetBrains IntelliJ IDEA, which was not sandboxed. This lack of sandboxing could potentially lead to security issues...
CVE-2023-28439
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages ...
CVE-2023-28100
CVE-2023-28100 affects Flatpak on Linux prior to versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. The root cause involves using the TIOCLINUX ioctl on Linux virtual consoles (e.g., /dev/tty1) which can allow a Flatpak app running in a console to copy text from the console into the command buffer and ...
Nautobot vulnerable to remote code execution via Jinja2 template rendering
Impact What kind of vulnerability is it? Who is impacted? All users of Nautobot versions earlier than 1.5.7 are impacted. In Nautobot 1.5.7 we have enabled sandboxed environments for the Jinja2 template engine used internally for template rendering for the following objects: - extras.ComputedFiel...
How to Detect New Threats via Suspicious Activities
Unknown malware presents a significant cybersecurity threat and can cause serious damage to organizations and individuals alike. When left undetected, malicious code can gain access to confidential information, corrupt data, and allow attackers to gain control of systems. Find out how to avoid...
CVE-2023-26081
CVE-2023-26081 affects Epiphany (GNOME Web) up to version 43.0, where autofill can exfiltrate passwords from sandboxed content (e.g., CSP sandbox or iframe). Exploitation would require untrusted web content, but attackers could leverage sandbox context to access credentials. Remediation across di...
SUSE CVE-2012-5155
Google Chrome before 24.0.1312.52 on Mac OS X does not use an appropriate sandboxing approach for worker processes, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors...
SUSE CVE-2016-5418
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file...
SUSE CVE-2017-5124
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted MHTML page...
is-http2 vulnerable to Improper Input Validation
All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...
Command injection
All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...
global-modules-path 安全漏洞
global-modules-path is a utility that returns the path of a global installation package. A security vulnerability exists in global-modules-path versions prior to 3.0.0, which stems from a lack of cleaning of user input or a failure to sandbox the getPath function...
