5530 matches found
This Week in Spring - August 1st, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! Can you believe it's already August 1, 2023??? Me either. As I write this, I'm preparing some of my contributions for SpringOne at VMWare Explore 2023, happening next month in lovely Las Vegas, NV. Have you registered yet? I'...
Moderate Photon OS Security Update - PHSA-2023-3.0-0623
Updates of 'linux-aws', 'linux', 'linux-secure', 'linux-esx', 'linux-rt' packages of Photon OS have been released...
Important Photon OS Security Update - PHSA-2023-3.0-0621
Updates of 'linux-aws', 'linux', 'linux-secure', 'linux-esx', 'linux-rt', 'openldap' packages of Photon OS have been released...
PenTales: There Are Many Ways to Infiltrate the Cloud
At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully...
MAL-2023-1118 Malicious code in aws-sdk-js-v3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e64c49f08b91cb456113ae44bbd8efc8280a1c79aa45ca1bd0f019c4af6ad873 The OpenSSF Package Analysis project identified 'aws-sdk-js-v3' @ 1.3.7 npm as malicious. It is considered malicious because: - The package...
USN-6252-1: Linux kernel vulnerabilities
It was discovered that the ext4 file system implementation in the Linux kernel contained a use-after-free vulnerability. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service system crash. CVE-2022-1184 It was discovered tha...
USN-6251-1: Linux kernel vulnerabilities
It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-3090 Sh...
U.S. Dept Of Defense: Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/
The host https://██████/ had a vulnerability in the /jenkins/script directory that allowed users to execute system commands on the host. This could have led to the disclosure of AWS IAM credentials, which could have been used by an attacker to manage various AWS resources, create and delete...
Zenbleed: New Flaw in AMD Zen 2 Processors Puts Encryption Keys and Passwords at Risk
A new security vulnerability has been discovered in AMD's Zen 2 architecture-based processors that could be exploited to extract sensitive data such as encryption keys and passwords. Discovered by Google Project Zero researcher Tavis Ormandy, the flaw – codenamed Zenbleed and tracked as...
Important Photon OS Security Update - PHSA-2023-4.0-0436
Updates of 'linux-aws', 'linux-secure', 'openssl', 'wireshark', 'grub2', 'linux-rt' packages of Photon OS have been released...
PT-2023-10181
Name of the Vulnerable Software and Affected Versions git-annex versions affected versions not specified Description The issue concerns the storage of embedded credentials on encrypted remotes in git-annex. When embedcreds=yes is set and the remote uses encryption=pubkey or encryption=hybrid, the...
GHSA-RFHG-RJFP-9Q8Q Potential denial of service after connection migration
Impact An issue in s2n-quic results in the endpoint shutting down due to a combination of peer-initiated connection migration and duplicate new connection ID frames being received. No AWS services are affected by this issue, and customers of AWS services do not need to take action. Impacted...
Potential denial of service after connection migration
Impact An issue in s2n-quic results in the endpoint shutting down due to a combination of peer-initiated connection migration and duplicate new connection ID frames being received. No AWS services are affected by this issue, and customers of AWS services do not need to take action. Impacted...
ec2-34-224-111-163.compute-1.amazonaws.com Cross Site Scripting vulnerability OBB-3545076
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel regression (USN-6191-1)
The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6191-1 advisory. USN-6081-1, USN-6084-1, USN-6092-1 and USN-6095-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a spurious warning ...
AWS Reliability Pillar: Consistent Cloud Architecture
Gain insight into the Reliability pillar of the AWS Well-Architected Framework and best practices for cloud-based operations, including change management and disaster recovery...
CVE-2023-37889
Cross-Site Request Forgery CSRF vulnerability in WPAdmin WPAdmin AWS CDN plugin = 2.0.13 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in WPAdmin WPAdmin AWS CDN plugin = 2.0.13 versions...
CVE-2023-37889 WordPress WPAdmin AWS CDN Plugin <= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in WPAdmin WPAdmin AWS CDN plugin = 2.0.13 versions...
