5262 matches found
CVE-2025-23206
The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...
CVE-2020-7599
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...
CVE-2024-41178
Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...
CVE-2022-23506
Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...
CVE-2022-31159
The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the...
Moderate Photon OS Security Update - PHSA-2026-5.0-0733
Updates of 'rubygem-aws-sdk-s3', 'samba-client' packages of Photon OS have been released...
0.workspace (>=0.1.0, <=0.1.1), 18a58t9c-upload (>=1.0.0, <=1.0.3) +18046 more potentially affected by unknown CVE via aws-sdk (>=2.0.0-rc1, <=2.1693.0)
aws-sdk NPM version =2.0.0-rc1, =0.1.0, =1.0.0, =0.21.0, =1.0.0, =1.0.0, =0.1.0, =3.6.0, =0.0.2, =0.3.0-2, =0.1.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J965-2QGJ-VJMQ...
Critical Photon OS Security Update - PHSA-2026-5.0-91-0732
Updates of 'glib', 'curl', 'capstone', 'aws-sdk-cpp' packages of Photon OS have been released...
Malicious Package
Overview aws-target-mediator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-129 Malicious code in aws-target-mediator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ebc5003f75ac973cedd53d212f4d9b3dc016b36e43b24ca0a10e77e485b9141 The package aws-target-mediator was found to contain malicious code. Source: ghsa-malware...
CVE-2022-27198
A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...
CVE-2022-27199
A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...
CVE-2025-1969
Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...
GHSA-GHW8-3XQW-HHCJ vulnerabilities
Vulnerabilities for packages: cert-manager-webhook-pdns, cert-exporter, cert-manager-cmctl, step-issuer, cert-manager-istio-csr, aws-privateca-issuer...
CVE-2024-12401 vulnerabilities
Vulnerabilities for packages: cert-manager-webhook-pdns, cert-exporter, cert-manager-cmctl, step-issuer, cert-manager-istio-csr, aws-privateca-issuer...
GHSA-F9JG-8P32-2F55 vulnerabilities
Vulnerabilities for packages: aws-efs-csi-driver-fips...
GHSA-GHW8-3XQW-HHCJ vulnerabilities
Vulnerabilities for packages: cert-manager-cmctl, cert-manager-webhook-pdns, cert-manager-webhook-pdns-fips, step-issuer, cert-exporter, cert-exporter-fips, aws-privateca-issuer-fips, cert-manager-istio-csr, cert-manager-cmctl-fips, aws-privateca-issuer, step-issuer-fips...
CVE-2024-12401 vulnerabilities
Vulnerabilities for packages: cert-manager-cmctl, cert-manager-webhook-pdns, cert-manager-webhook-pdns-fips, step-issuer, cert-exporter, cert-exporter-fips, aws-privateca-issuer-fips, cert-manager-istio-csr, cert-manager-cmctl-fips, aws-privateca-issuer, step-issuer-fips...
Server-side Request Forgery (SSRF)
Overview io.spinnaker.clouddriver:clouddriver-aws is a Spinnaker Clouddriver Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper restrictions on user-supplied URLs when fetching data. An attacker can access internal resources, extract sensitive...
