Lucene search
+L

5525 matches found

NVD
NVD
added 2023/06/28 2:15 p.m.51 views

CVE-2023-36467

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue...

8.8CVSS8.6AI score0.0118EPSS
SaveExploits0References4
Prion
Prion
added 2023/06/28 2:15 p.m.23 views

Remote code execution

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue...

6.5CVSS8.8AI score0.0118EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 2023/06/28 1:55 p.m.26 views

CVE-2023-36467 AWS data.all vulnerable to RCE through user injection of Python Commands

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue...

8CVSS7.7AI score0.0118EPSS
SaveExploits0References4
OSV
OSV
added 2023/06/28 1:55 p.m.35 views

CVE-2023-36467 AWS data.all vulnerable to RCE through user injection of Python Commands

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue...

8CVSS8.7AI score
SaveExploits0References6
CVE
CVE
added 2023/06/28 1:55 p.m.55 views

CVE-2023-36467

CVE-2023-36467 concerns AWS data.all, an open-source data marketplace framework. The connected sources confirm that versions 1.2.0 through 1.5.1 are vulnerable to remote code execution when an authenticated user injects Python commands into the Template field during data pipeline configuration. T...

8.8CVSS8.5AI score0.0118EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 2023/06/28 1:55 p.m.55 views

CVE-2023-36467 AWS data.all vulnerable to RCE through user injection of Python Commands

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue...

8CVSS9.1AI score0.0118EPSS
SaveExploits0References4
Rapid7 Blog
Rapid7 Blog
added 2023/06/27 5:56 p.m.21 views

Standardizing SaaS Data to Drive Greater Cloud Security Efficacy

The way we do business has fundamentally changed, and as a result, so must security. Whether it’s legacy modernization initiatives, process improvements, or bridging the gap between physical and digital—most organizational strategies and initiatives involve embracing the cloud. However, investing...

6.7AI score
SaveExploits0
Veracode
Veracode
added 2023/06/26 10:19 a.m.26 views

Arbitrary File Read

AWS CodeCommit Trigger Plugin is vulnerable to Arbitrary File Reads. The vulnerability exists due to a failure to restrict the queue name path parameter in the corresponding HTTP endpoint which allows an attacker to read arbitrary files on the Jenkins controller file system...

6.5CVSS6.7AI score0.0063EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2023/06/23 10:15 p.m.21 views

CVE-2023-1783

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF...

7.6CVSS6.8AI score0.00576EPSS
SaveExploits1References2
NVD
NVD
added 2023/06/23 10:15 p.m.31 views

CVE-2023-1783

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF...

7.6CVSS6.5AI score0.00576EPSS
SaveExploits1References2
Prion
Prion
added 2023/06/23 10:15 p.m.23 views

Hardcoded credentials

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF...

4.9CVSS7.4AI score0.00576EPSS
SaveExploits1References2Affected Software1
Vulnrichment
Vulnrichment
added 2023/06/23 9:55 p.m.11 views

CVE-2023-1783 OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF...

6.5CVSS6.6AI score0.00576EPSS
SaveExploits1References2
CVE
CVE
added 2023/06/23 9:55 p.m.64 views

CVE-2023-1783

OrangeScrum 2.0.11 is vulnerable to a flaw in HTML-to-PDF rendering that allows an external attacker to remotely obtain AWS instance credentials. The root cause is improper validation of HTML content during PDF conversion, leading to credentials leakage (impacting confidentiality). The most expli...

7.6CVSS6.8AI score0.00576EPSS
SaveExploits1References2Affected Software1
Cvelist
Cvelist
added 2023/06/23 9:55 p.m.35 views

CVE-2023-1783 OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF...

6.5CVSS7.6AI score0.00576EPSS
SaveExploits1References2
NVD
NVD
added 2023/06/23 9:15 p.m.70 views

CVE-2023-35165

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

8.8CVSS7.5AI score0.00897EPSS
SaveExploits1References2
Prion
Prion
added 2023/06/23 9:15 p.m.28 views

Code injection

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

6.5CVSS8.9AI score0.00897EPSS
SaveExploits1References2Affected Software1
Cvelist
Cvelist
added 2023/06/23 8:32 p.m.56 views

CVE-2023-35165 AWS CDK EKS overly permissive trust policies

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

6.6CVSS9.2AI score0.00897EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
added 2023/06/23 8:32 p.m.15 views

CVE-2023-35165 AWS CDK EKS overly permissive trust policies

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

6.6CVSS7.4AI score0.00897EPSS
SaveExploits1References2
CVE
CVE
added 2023/06/23 8:32 p.m.207 views

CVE-2023-35165

CVE-2023-35165 concerns the AWS CDK EKS trust policies. In affected releases of aws-cdk-lib (2.0.0–2.80.0) and @aws-cdk/aws-eks (1.57.0–1.202.0), eks.Cluster and eks.FargateCluster create two roles, CreationRole and default MastersRole, with overly permissive trust policies. The CreationRole is u...

8.8CVSS7.8AI score0.00897EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2023/06/23 8:32 p.m.40 views

CVE-2023-35165 AWS CDK EKS overly permissive trust policies

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

6.6CVSS8.8AI score
SaveExploits0References4
Rows per page
Query Builder