CVE-2023-45798

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

Input validation

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

CVE-2023-45798

Affected product: Yettiesoft VestCert, versions 2.36–2.5.29. Root cause: improper validation of third-party modules allows loading arbitrary third-party modules, enabling remote code execution. Impact: remote code execution with high risk (CVE-2023-45798). The CVE notes indicate vulnerability is ...

PT-2023-29692 · Yettiesoft · Vestcert

Name of the Vulnerable Software and Affected Versions: Yettiesoft VestCert versions 2.36 to 2.5.29 Description: A vulnerability exists in Yettiesoft VestCert due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote co...

Yettiesoft VestCert Security Vulnerability

Yettiesoft VestCert is an application from Yettiesoft, Inc. A security vulnerability exists in Yettiesoft VestCert versions 2.36 through 2.5.29 that stems from improper validation of third-party modules, which allows malicious actors to load arbitrary third-party modules that can lead to remote...

Tenable Identity Exposure < 3.42.17 Multiple Vulnerabilities (TNS-2023-33)

According to its self-reported version, the Tenable Identity Exposure running on the remote host is prior to 3.42.17. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-33 advisory. Tenable Identity Exposure leverages third-party software to help provide underlyi...

Tenable Nessus Network Monitor < 6.3.0 Multiple Vulnerabilities (TNS-2023-34)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-46667

An issue was discovered in Fleet Server = v8.10.0 and v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in th...

CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File

An issue was discovered in Fleet Server = v8.10.0 and v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in th...

CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File

An issue was discovered in Fleet Server = v8.10.0 and v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in th...

CVE-2023-46667

Fleet Server vulnerability CVE-2023-46667 affects Fleet Server 8.10.0–8.10.2 where enrolment tokens are written in plaintext to log files, potentially enabling unauthorized agent enrolment and access to secrets (Elasticsearch and third‑party services) or arbitrary events. Exploitation is not desc...

Strategic Tips to Optimize Cybersecurity Consolidation

Say goodbye to security silos. Organizations are eager to take advantage of cybersecurity consolidation and make their security environments more manageable. Evolving incrementally and adopting a platform that supports third-party integrations are key to reducing cybersecurity complexity...

[R1] Nessus Network Monitor 6.3.0 Fixes Multiple Vulnerabilities

R1 Nessus Network Monitor 6.3.0 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 10/25/2023 - 15:33 Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, curl, chosen, datatables were found to contain...

Hardcoded credentials

The vulnerability allows an unprivileged untrusted third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcode...

CVE-2023-41372

The vulnerability allows an unprivileged untrusted third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcode...

CVE-2023-41960

The vulnerability allows an unprivilegeduntrusted third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application itself...

PT-2023-27933 · Google · Android Client

Name of the Vulnerable Software and Affected Versions: Android Client application affected versions not specified Description: The issue allows an unprivileged third-party application to arbitrarily modify the server settings of the Android Client application, causing it to connect to a malicious...

[R1] Tenable Identity Exposure Version 3.42.17 Fixes Multiple Vulnerabilities

R1 Tenable Identity Exposure Version 3.42.17 Fixes Multiple Vulnerabilities Jason Schavel Mon, 10/23/2023 - 11:51 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components RabbitMQ, libcurl, and nodeJS were found to...

Enabled modules after been activated cannot subsequently be disabled

Lines of code Vulnerability details Impact Modules are third party accounts and they have some level of access to the GnosisSafe depending on configuration by the account owner. Therefore, they are created and assigned by account owners and they can execute transactions independently but they...

the operators of the sub account can execute any transaction(not restricted by policy ) to a 3rd party without going through the policy validation process by the trustedValidator

Lines of code Vulnerability details Impact this vulnerability will cause the tokens of the sub accounts to be stolen or perform any activity on the subAcoounts without the validation against the policy and will allow the operators to execute transactions that are not restricted by the policy of t...