HTTP/2 Rapid Reset Zero-Day Vulnerability Exploited to Launch Record DDoS Attacks

Amazon Web Services AWS, Cloudflare, and Google on Tuesday said they took steps to mitigate record-breaking distributed denial-of-service DDoS attacks that relied on a novel technique called HTTP/2 Rapid Reset. The layer 7 attacks were detected in late August 2023, the companies said in a...

Remote Code Execution

fsevents is vulnerable to Remote Code Execution. The vulnerability is caused by loading a fsevents binary from an arbitrary AWS S3 bucket during installation. This S3 bucket URL was vulnerable to take over by malicious actors, but a security researcher claimed the bucket URL to protect against...

ec2-18-208-106-147.compute-1.amazonaws.com Cross Site Scripting vulnerability OBB-3736717

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

How to Protect Against Data Lake Hacking

Data lakes, or centralized repositories for large-scale data, are a popular solution for data storage, and there are good reasons for that. Data lakes are flexible and cost-effective, as they allow many object formats and multiple query engines, and there is no need to manage or pay for resources...

ec2-3-6-251-175.ap-south-1.compute.amazonaws.com Cross Site Scripting vulnerability OBB-3736714

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Multi-factor authentication has proven it works, so what are we waiting for?

Recently, Amazon announced that it will require all privileged Amazon Web Services AWS accounts to use multi-factor authentication MFA, starting in mid-2024. Our regular readers will know that we feel that passwords alone are not adequate protection, especially not for your important accounts. So...

GitHub's Secret Scanning Feature Now Covers AWS, Microsoft, Google, and Slack

GitHub has announced an improvement to its secret scanning feature that extends validity checks to popular services such as Amazon Web Services AWS, Microsoft, Google, and Slack. Validity checks, introduced by the Microsoft subsidiary earlier this year, alert users whether exposed tokens found by...

Important Photon OS Security Update - PHSA-2023-3.0-0661

Updates of 'linux-aws', 'linux', 'bindutils', 'linux-secure', 'linux-esx', 'linux-rt' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-4.0-0483

Updates of 'linux-esx', 'linux-aws', 'netkit-telnet', 'linux', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, ha...

TorchServe Server-Side Request Forgery vulnerability

Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...

GHSA-8FXR-QFR9-P34W TorchServe Server-Side Request Forgery vulnerability

Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...

GHSA-4MQG-H5JF-J9M7 TorchServe Pre-Auth Remote Code Execution

Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...

TorchServe Pre-Auth Remote Code Execution

Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...

JetBrains TeamCity < 2022.10.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2022.10.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. CVE-2022-46830 - In JetBrains TeamCity between...

Moderate Photon OS Security Update - PHSA-2023-4.0-0480

Updates of 'linux-esx', 'linux-aws', 'linux', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

Unlocking Seamless API Security: Revenera’s Journey with Wallarm

In today's digital landscape, ensuring the security of web applications and APIs is paramount. The journey to find the right security solution can be filled with challenges and choices. In this blog post, we'll dive into the experience of Rob Davies, VP of Engineering and Lead Architect at...

AWS Graviton Use Cases

Discover how AWS Graviton’s optimized processors help provide a superior price-performance ratio. Available for AWS-managed services, you’ll gain insight on strategies, use cases, and insight on how to get the most out of AWS Graviton...

Ubuntu: Security Advisory (USN-6396-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

'Unauthorized to make an AWS request.' When Using AWS Israel Region

Challenge When creating a new AWS S3 Object Storage Repository with the recently launched AWS Israel region il-central-1, configuring a Helper Appliance fails with the error: Unauthorized to make an AWS request. Cause This error occurs because the AWS SDK libraries used by Veeam Backup &...