GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: bank-vaults, flux-image-automation-controller, prometheus-statsd-exporter, node-problem-detector, pulumi-language-yaml, kubeflow-fips, sigstore-scaffolding, haproxy-ingress, flux-image-reflector-controller, kubevela, prometheus-mongodb-exporter,...

Google, Cloudflare, and AWS Disclose Largest DDoS Attack in History

By Deeba Ahmed Google, Cloudflare, and AWS Disclosed Digital History’s Largest Ever DDoS Attack- Courtesy HTTP/2 Zero-day. This is a post from HackRead.com Read the original post: Google, Cloudflare, and AWS Disclose Largest DDoS Attack in History...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: node-problem-detector, pulumi-language-yaml, kubeflow-fips, scorecard, sigstore-scaffolding, haproxy-ingress, kubevela, flux-source-controller, helm, terraform-provider-sendgrid, ip-masq-agent, pulumi-language-java, gitness, minio, kots, fuse-overlayfs-snapshotter,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: cortex, kaf, memcached-exporter, terraform, weaviate, hugo, flux-kustomize-controller, flux-helm-controller, nghttp2, rqlite, conftest, atlantis, haproxy-ingress, aactl, kpt, nri-prometheus, hey, buildkitd, flux-source-controller, nginx-mainline,...

Attacking AWS Cognito with Pacu (p2)

The post Attacking AWS Cognito with Pacu p2 appeared first on Rhino Security Labs...

Attacking AWS Cognito with Pacu (p1)

The post Attacking AWS Cognito with Pacu p1 appeared first on Rhino Security Labs...

HTTP/2 Rapid Reset Zero-Day Vulnerability Exploited to Launch Record DDoS Attacks

Amazon Web Services AWS, Cloudflare, and Google on Tuesday said they took steps to mitigate record-breaking distributed denial-of-service DDoS attacks that relied on a novel technique called HTTP/2 Rapid Reset. The layer 7 attacks were detected in late August 2023, the companies said in a...

Remote Code Execution

fsevents is vulnerable to Remote Code Execution. The vulnerability is caused by loading a fsevents binary from an arbitrary AWS S3 bucket during installation. This S3 bucket URL was vulnerable to take over by malicious actors, but a security researcher claimed the bucket URL to protect against...

ec2-18-208-106-147.compute-1.amazonaws.com Cross Site Scripting vulnerability OBB-3736717

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

How to Protect Against Data Lake Hacking

Data lakes, or centralized repositories for large-scale data, are a popular solution for data storage, and there are good reasons for that. Data lakes are flexible and cost-effective, as they allow many object formats and multiple query engines, and there is no need to manage or pay for resources...

ec2-3-6-251-175.ap-south-1.compute.amazonaws.com Cross Site Scripting vulnerability OBB-3736714

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Multi-factor authentication has proven it works, so what are we waiting for?

Recently, Amazon announced that it will require all privileged Amazon Web Services AWS accounts to use multi-factor authentication MFA, starting in mid-2024. Our regular readers will know that we feel that passwords alone are not adequate protection, especially not for your important accounts. So...

GitHub's Secret Scanning Feature Now Covers AWS, Microsoft, Google, and Slack

GitHub has announced an improvement to its secret scanning feature that extends validity checks to popular services such as Amazon Web Services AWS, Microsoft, Google, and Slack. Validity checks, introduced by the Microsoft subsidiary earlier this year, alert users whether exposed tokens found by...

Important Photon OS Security Update - PHSA-2023-3.0-0661

Updates of 'linux-aws', 'linux', 'bindutils', 'linux-secure', 'linux-esx', 'linux-rt' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-4.0-0483

Updates of 'linux-aws', 'linux-rt', 'linux-esx', 'linux-secure', 'netkit-telnet', 'linux' packages of Photon OS have been released...

Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, ha...

TorchServe Server-Side Request Forgery vulnerability

Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...

GHSA-8FXR-QFR9-P34W TorchServe Server-Side Request Forgery vulnerability

Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...

GHSA-4MQG-H5JF-J9M7 TorchServe Pre-Auth Remote Code Execution

Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...

TorchServe Pre-Auth Remote Code Execution

Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...