GHSA-Q78C-GWQW-JCMC vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, aws-efs-csi-driver, kubeflow-pipelines...

GHSA-7FXM-F474-HF8W vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips...

GHSA-Q78C-GWQW-JCMC vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, kubeflow-pipelines...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, aws-efs-csi-driver, kubeflow-pipelines...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, kubeflow-pipelines...

CVE-2023-3676 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips...

USN-6465-1: Linux kernel vulnerabilities

Yu Hao and Weiteng Chen discovered that the Bluetooth HCI UART driver in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service system crash. CVE-2023-31083 Lin Ma discovered that the Netlink...

USN-6462-1: Linux kernel vulnerabilities

Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu memory management structure. A local attacker could use this to expose sensitive information kernel memory or in conjunction with another kernel vulnerability. CVE-2023-0597 Yu Hao and Weite...

EleKtra-Leak Cryptojacking Attacks Exploit AWS IAM Credentials Exposed on GitHub

A new ongoing campaign dubbed EleKtra-Leak has set its eyes on exposed Amazon Web Service AWS identity and access management IAM credentials within public GitHub repositories to facilitate cryptojacking activities. "As a result of this, the threat actor associated with the campaign was able to...

Minter can censor GATEKEEPER and mint uncollateralized for a prolonged period of time

Lines of code Vulnerability details Impact Ethena explicitly mentions their protection against a compromised minter, the mentioned maximum loss is $100.000. The protection against a compromised minter rests on the GATEKEEPER role which is a system running on AWS set to remove the minter if mints...

CloudPulse - AWS Cloud Landscape Search Engine

During the reconnaissance phase, an attacker searches for any information about his target to create a profile that will later help him to identify possible ways to get in an organization. CloudPulse is a powerful tool that simplifies and enhances the analysis of SSL certificate data. It leverage...

Ubuntu: Security Advisory (USN-6440-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow-fips, metrics-server-fips, kube-oidc-proxy, kubernetes-csi-livenessprobe, prometheus-blackbox-exporter, slsa-verifier, prometheus-adapter-fips, timestamp-authority-fips, volume-modifier-for-k8s-fips, kubeflow, aws-efs-csi-driver-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, dgraph, kubescape, kubevela, buildkitd, src, aactl, k3d, up, cortex, terraform-provider-sendgrid, kubeflow, scorecard, slsa-verifier...

CVE-2023-34085

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

Cross site request forgery (csrf)

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

USN-6440-3: Linux kernel (HWE) vulnerabilities

Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu memory management structure. A local attacker could use this to expose sensitive information kernel memory or in conjunction with another kernel vulnerability. CVE-2023-0597 It was discovere...

CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085

CVE-2023-34085 describes a vulnerability where, if an AWS DynamoDB table is used for storing user attributes, an attacker can craft a request to retrieve another user’s attributes. The connected records corroborate this label and tie the issue to Ping Identity PingFederate and related disclosures...