AWS Connection Session Provisioner’s SHA256 hash is not fully verified by PCoIP Zero Clients

HP has provided updated versions of Tera2 Zero Client firmware that remediate vulnerabilities found in firmware version 22.04 and earlier. Products can be updated or replaced with the latest release by downloading from the Teradici website and following standard installation or update instruction...

aws-iam-authenticator 安全漏洞

aws-iam-authenticator is a Kubernetes SIGs open source tool for authenticating to a Kubernetes cluster using AWS IAM credentials. A security vulnerability exists in Kubernetes SIGs aws-iam-authenticator that stems from a whitelisted IAM identity being able to modify its username and elevate...

PT-2022-16291

Name of the Vulnerable Software and Affected Versions aws-iam-authenticator versions prior to 0.5.9 Description A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges. Recommendations For versions...

openSUSE: Security Advisory for resource-agents (SUSE-SU-2022:2326-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

U.S. Dept Of Defense: SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]

Summary: I found that it is possible to inject a javascript payload during the PDF form creation process, which is then executed by the checklist application server. Vulnerable Software: Functional Administrative Support Tool FAST v1.0 Intro: ██████████ Administrative clerks create a dynamic acti...

U.S. Dept Of Defense: Full read SSRF at █████████ [HtUS]

Heyy there, We have found a full read ssrf vuln in https://█████ , we were able to hit the AWS Metadata endpoint http://███████ though the SSRF Vuln. ------------ Steps to reproduce: 1.Goto https://██████/users/create and create an account 2.After you account is verified , get login If for some...

Fedora: Security Advisory for golang-github-uber-athenadriver (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-aws-lambda (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for mass3 (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

U.S. Dept Of Defense: SSRF to read AWS metaData at https://█████/ [HtUS]

Hello Team, While researching your program I found that the domain https://████/ is vulnerable to Server Side Request Frogery Attacks via the url parameter. An attacker is able to fetch the aws metadata abusing the SSRF at https://████████/...

U.S. Dept Of Defense: SSRF ACCESS AWS METADATA - █████

Hi Security Team, Based on https://hackerone.com/hack-us-h1c challenge, I have urgent vulnerability and the challenge doesn't accept reprots for now 1:56 AM . I have found a SSRF Vulnerability which allow access to the AWS metadata, using Parameter ?url= as shown blew An attacker can tunnel into...

Cloud OSINT. Finding Interesting Resources

Locating sensitive information, personally identifiable information PII and questionable assets in the cloud. TL; DR I had a curiosity driven excursion into the public clouds of AWS and Azure to find what is publicly hosted and who by. As anticipated, the results were extremely broad and...

[SECURITY] Fedora 36 Update: mass3-0-0.6.20200627gite1d5f1a.fc36

Quickly enumerate through a pre-compiled list of AWS S3 buckets using DNS instead of HTTP with a list of DNS resolvers and multi-threading...

[SECURITY] Fedora 36 Update: golang-github-uber-athenadriver-1.1.12-5.fc36

A fully-featured AWS Athena database driver...

[SECURITY] Fedora 36 Update: golang-github-aws-lambda-1.26.0-4.fc36

Libraries, samples and tools to help Go developers develop AWS Lambda functions...

GO-2022-0391 Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...

How to Monitor Athena Usage to Understand Your Operations, and Control Security and Costs

Introduction to our data lakes experience Data lakes are great. They are flexible as they allow many object formats and multiple query engines. They are also cost effective - there is no need to manage or pay for resources like disks, cpu and memory. Data is simply stored in an object store and i...

awsEnum - Enumerate AWS Cloud Resources Based On Provided Credential

Enumrate AWS services! with no nosies awsEnum is a python script enumrate AWS services through the provided credential. ▄▄▄▄▄▄ ▄ ▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄ ▄ ▄▄ ▄▄ ▄▄ ▄▄ █ █ █ ▄ █ █ █ █ █ █ █ █ █ █ █▄█ █ █ ▄ █ ██ ██ █ ▄▄▄▄▄█ ▄▄▄█ █▄█ █ █ █ █ █ █ █▄█ █ █ █▄▄▄▄▄█ █▄▄▄█ █ █▄█ █ █ █ █ █▄▄▄▄▄ █ ▄▄▄█ ▄ █ █ █...

CloudGoat detection_evasion Scenario: Avoiding AWS Security Detection and Response

The post CloudGoat detectionevasion Scenario: Avoiding AWS Security Detection and Response appeared first on Rhino Security Labs...

Malicious Package

pygrata-utils is a malicious package. The library attempts to harvest and upload the AWS credentials, network interface information and environment variables to a remote endpoint: "hxxp://graph.pygrata.com:8000/upload."...