5219 matches found
CVE-2024-45290
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided...
CVE-2024-4084
A Server-Side Request Forgery SSRF vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172...
Daas unable to create host connection with error: "URL invalid"
Unable to create a host connection to AWS EC2 and on-premises hypervisors XenServer, VMWare, etc. with invalid URL or authentication failure when a proxy has been configured for the Network Service account...
AWS VDP: Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The vulnerability allows adversaries to silently enumerate permissions of compromised AWS credentials for the CloudWatch service without generating logs in CloudTrail. Two non-production API endpoints were identified that can be accessed with standard IAM credentials but do not log the activity...
MAL-2025-1021 Malicious code in aws-genai-llm-chatbot (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in aws-genai-llm-chatbot (npm)
The package communicates with a domain associated with malicious activity...
FUNNULL Unmasked: AWS, Azure Abused for Global Cybercrime Operations
Discover how cybercriminals use 'Infrastructure Laundering' to exploit AWS and Azure for scams, phishing, and money laundering. Learn about FUNNULL CDN's tactics and their global impact on businesses and cybersecurity...
The Basics of AWS Infrastructure Security
Discover key strategies to strengthen your AWS security posture, from applying protection at all layers to understanding shared responsibility in the cloud...
CVE-2024-45336 vulnerabilities
Vulnerabilities for packages: nvidia-nsight-compute-13.0, git-sync-fips, sftpgo-plugin-pubsub, opentelemetry-collector-contrib-fips, kubernetes-dashboard-api-fips, harbor, vexctl, harbor-scanner-trivy-fips, kaniko, nginx-prometheus-exporter-fips, prometheus-beat-exporter-fips, cloudnative-pg,...
CVE-2025-0693
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account...
CVE-2025-0693 Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account...
CVE-2025-0693
AWS IAM (Identity and Access Management) is affected. The issue arises in the sign-in flow where variable response times could be exploited to enumerate valid usernames in an AWS account. Impact is described as enabling brute-force username discovery; no explicit exploit vectors or mitigations ar...
PT-2025-4003 · Amazon · Aws Sign-In Iam
Name of the Vulnerable Software and Affected Versions: AWS IAM affected versions not specified Description: The issue is related to variable response times in the AWS Sign-in IAM user login flow, which allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an...
GHSA-V4MQ-X674-FF73 AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...
CVE-2025-23206
The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...
CVE-2025-23206
The CVE-2025-23206 issue affects AWS CDK (IAM OIDC custom resource workflow). The tls.connect call sets rejectUnauthorized: false, enabling potential MITM risk when downloading CA thumbprints. A patch is in progress; remediation guidance in the connected docs recommends upgrading to CDK v2.177.0 ...
CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...
CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...
