Oct 2, 2023

Started

• ClosedHigh✓Patched

  Google Chromium libvpx: Heap Buffer Overflow (CVE-2023-5217)

  Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome. Added to CISA KEV on 2023-10-02.

  Google Chromium libvpx·Closed Oct 2, 2023·updated Oct 2, 2023

Updated

• ClosedHigh–No fix needed

  Okta support system breach: HAR files with session tokens stolen

  An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.

  Okta Help Center (customer support system)·Closed Nov 29, 2023·updated Nov 29, 2023