Cross-site Request Forgery (CSRF)

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the AWS auth manager SAML login flow, where login discards the AuthnRequest id...

CVE-2026-86467

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467

The Apache Airflow Amazon provider is vulnerable to a login-CSRF attack via the AWS auth manager 's SAML login flow. The vulnerability occurs because the login handler discards the AuthnRequest ID and the callback validates assertions without requiring a matching InResponseTo value. This allows a...

CVE-2026-86467

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

EUVD-2026-104790

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

aws-log4j-mitigations

aws-log4j-mitigations Mitigations to implement on AWS to attempt to prevent log4j exploitation. Using WAFv2 with Ansible. Inspired by: https://github.com/OllieJC/aws-log4j-mitigations...

PT-2026-118648

Name of the Vulnerable Software and Affected Versions AWS CICD-toolchain-for-serverless-applications versions 1.0.7 through 1.0.10 Description Incorrect privilege assignment in the IAM policy allows remote authenticated users with push access to the application source repository to escalate...

PT-2026-118101

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

apche-struts-vuln-demo-cve-2018-11776

Apache Struts Vulnerability Demo CVE-2018-11776 Description Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776. Getting Started To bring up the test environment, run the following command: aws cloudformation create-stack \ --template-body...

MozDef

MozDef: ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla Enterprise Defense Platform MozDef project. Please fork it to continue development. Documentation: https://mozdef.readthedocs.org/en/latest/ Give MozDef a Try in AWS: The following button will launch the Mozilla...

domain-protect

domain-protect Domain Protect is now an OWASP project moved to: github.com/domain-protect/domain-protect...

aws-recon

AWS Recon A multi-threaded AWS security-focused inventory collection tool written in Ruby. This tool was created to facilitate efficient collection of a large amount of AWS resource attributes and metadata. It aims to collect nearly everything that is relevant to the security configuration and...

bucky

Bucky An S3 account ID enumeration and bucket discovery tool Given a single accessible S3 bucket, bucky extracts the 12-digit AWS account ID that owns it, then discovers additional buckets belonging to the same account by fuzzing bucket names against a wordlist — all in one command. What It Does ...

sisu

sisu ⚡ Your AWS, as a filesystem. This: grep -l "AdministratorAccess" iam/users//policies.json Instead of this: aws iam list-users --query 'Users.UserName' --output text | \ xargs -I sh -c 'aws iam list-attached-user-policies --user-name --query "AttachedPolicies.PolicyArn" --output text' | \ gre...

GHSA-74VM-87HJ-R66F vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53resolver, crossplane-provider-aws-autoscaling-fips, crossplane-provider-aws-route53recoverycontrolconfig, crossplane-provider-aws-route53recoverycontrolconfig-fips, grafana, grafana-fips, crossplane-provider-aws-opensearchserverless-fip...

CVE-2026-100349 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53resolver, crossplane-provider-aws-autoscaling-fips, crossplane-provider-aws-route53recoverycontrolconfig, crossplane-provider-aws-route53recoverycontrolconfig-fips, grafana, grafana-fips, crossplane-provider-aws-opensearchserverless-fip...

aws__aws-sdk-java_CVE-2022-31159_1-12-2600

AWS SDK for Java The AWS SDK for Java enables Java developers to easily work with Amazon Web Servicesaws and build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. See the AWS SDK for Java 2.xaws-sdk-for-java-2x for how to get started. In Maintenance Mode as of July 3...

AWS-SAM-CLI-Vulnerabilities

AWS SAM CLI Vulnerabilities CVE-2025-3047 & CVE-2025-3048 This README provides a detailed analysis of two security vulnerabilities found in the AWS Serverless Application Model CLI AWS SAM CLI – CVE-2025-3047 and CVE-2025-3048 – along with the code-level issues and fixes. Both vulnerabilities...

GHSA-VRCC-3CH7-HPPW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cur, crossplane-provider-aws-s3, crossplane-provider-aws-autoscaling, crossplane-provider-azure-marketplaceordering, crossplane-provider-azure-servicelinker, crossplane-provider-aws-macie2-fips, crossplane-provider-aws-neptune,...