CVE-2023-0093

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need t...

Command injection

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need t...

CVE-2023-0093

CVE-2023-0093 affects Okta Advanced Server Access Client versions 1.13.1–1.65.0. The root cause is a vulnerable third‑party library, webbrowser , used by the ASA client, enabling command injection . Exploitation requires the user to be phished into entering an attacker‑controlled server URL durin...

CVE-2023-0093

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need t...

CVE-2023-0093

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need t...

Cockpit Uses Platform-Dependent Third Party Components

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit 2.3.9 and prior. A patch is available and anticipated to be part of version 2.4.0...

GHSA-P8CQ-PV6W-6RWX Cockpit Uses Platform-Dependent Third Party Components

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit 2.3.9 and prior. A patch is available and anticipated to be part of version 2.4.0...

CVE-2023-1160

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

Code injection

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

PT-2023-16790 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: cockpit versions prior to 2.4.0 Description: The issue concerns the use of platform-dependent third-party components in the GitHub repository cockpit-hq/cockpit. A patch is available and is anticipated to be part of version 2.4.0...

Cockpit 安全漏洞

Cockpit is an interactive server management interface. A security vulnerability exists in Cockpit versions prior to 2.4.0, which stems from the use of platform-dependent third-party components...

CVE-2023-1160

CVE-2023-1160 affects cockpit-hq/cockpit prior to version 2.4.0 due to use of platform-dependent third‑party components. The root cause is the incorporation of non-uniform components that vary by platform, leading to compatibility and risk concerns described across multiple sources. The documente...

CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

[R2] Nessus Version 10.5.0 Fixes Multiple Vulnerabilities

R2 Nessus Version 10.5.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 03/02/2023 - 12:42 Nessus leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, spin.js, datatables.net were found to contain vulnerabilities, and updated...

LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults

LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems. The company said one of its DevOps engineers had their personal home compute...

LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults

LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems. The company said one of its DevOps engineers had their personal home compute...

Design/Logic Flaw

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...

Shocking Findings from the 2023 Third-Party App Access Report

Spoiler Alert: Organizations with 10,000 SaaS users that use M365 and Google Workspace average over 4,371 additional connected apps. SaaS-to-SaaS third-party app installations are growing nonstop at organizations around the world. When an employee needs an additional app to increase their...

CVE-2022-45139 WAGO: Origin validation error through CORS misconfiguration

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...