Sandstorm
Products
1- 4 CVEs
Recent CVEs
4| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-6198 | Med | 0.42 | 6.5 | 0.01 | Feb 6, 2018 | The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space. | ||
| CVE-2017-6201 | Hig | 0.00 | 8.1 | 0.02 | Feb 6, 2018 | A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs… | ||
| CVE-2017-6200 | Med | 0.00 | 6.5 | 0.02 | Feb 6, 2018 | Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name. | ||
| CVE-2017-6199 | Cri | 0.00 | 9.8 | 0.03 | Feb 6, 2018 | A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field. |
- risk 0.42cvss 6.5epss 0.01
The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space.
- risk 0.00cvss 8.1epss 0.02
A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs…
- risk 0.00cvss 6.5epss 0.02
Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name.
- risk 0.00cvss 9.8epss 0.03
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.