CVE-2023-43651: Improper Control of Generation of Code

JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provid...

Jumpserver Authorization Issues Vulnerability

Jumpserver is an open source bastion machine from Hangzhou Feizhiyun Information Technology Co. in China. JumpServer suffers from an authorization issue vulnerability that stems from the fact that when a user enables MFA and authenticates with a public key, the Koko SSH server does not validate t...

CVE-2023-43652: Missing Authorization

JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used ...

CVE-2023-42818: Improper Authentication

JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication...

CVE-2023-28110

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the...

Design/Logic Flaw

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the...

CVE-2023-28110 JumpServer Koko vulnerable to Command Injection for Kubernetes Connection

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the...

CVE-2023-28110

CVE-2023-28110 affects Jumpserver’s Koko component (Go version of coco). Before v2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko enables a command injection that can disrupt the Koko container environment and impact normal operation. The issue has a fixed release in v...

CVE-2023-28110 JumpServer Koko vulnerable to Command Injection for Kubernetes Connection

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the...

CVE-2023-28110 JumpServer Koko vulnerable to Command Injection for Kubernetes Connection

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the...

CVE-2023-28110: Improper Neutralization of Special Elements used in a Command

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the...

Jumpserver 命令注入漏洞

Jumpserver is an open source bastion from Hangzhou Feizhiyun Information Technology Co. in China. A command injection vulnerability exists in Jumpserver versions prior to 2.28.8. Attackers use this vulnerability to connect to a Kubernetes cluster via Koko using an illegal token, resulting in the...

KOKO - 理財就是這麼簡單！ - Customized SSL, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application KOKO - 理財就是這麼簡單！ published at the 'play' market has multiple vulnerabilities...