Moderate Photon OS Security Update - PHSA-2021-0031

Updates of 'linux-aws', 'linux-secure', 'zookeeper', 'linux-rt', 'linux' packages of Photon OS have been released...

How to Address the Current Complexity and Chaos of Cloud IAM

Cloudy judgement Combining the separate themes of cloud technology and identity access management IAM might seem like an oxymoron in today’s endlessly scaling environments, but there’s really no going back in the box when it comes to the promise of cloud in driving innovation. The fact is, securi...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +98 more potentially affected by CVE-2021-29532 via tensorflow-cpu (>=1.15.0 <=2.2.0)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.0.1, =0.3.3 and more Source cves: CVE-2021-29532 Source advisory: OSV:PYSEC-2021-460...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +98 more potentially affected by CVE-2021-29540 via tensorflow-cpu (>=1.15.0 <=2.2.0)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.0.1, =0.3.3 and more Source cves: CVE-2021-29540 Source advisory: OSV:PYSEC-2021-468...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +98 more potentially affected by CVE-2021-29514 via tensorflow-cpu (>=1.15.0 <=2.2.0)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.0.1, =0.3.3 and more Source cves: CVE-2021-29514 Source advisory: OSV:PYSEC-2021-442...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +98 more potentially affected by CVE-2021-29546 via tensorflow-cpu (>=1.15.0 <=2.2.0)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.0.1, =0.3.3 and more Source cves: CVE-2021-29546 Source advisory: OSV:PYSEC-2021-474...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +98 more potentially affected by CVE-2021-29560 via tensorflow-cpu (>=1.15.0 <=2.2.0)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.0.1, =0.3.3 and more Source cves: CVE-2021-29560 Source advisory: OSV:PYSEC-2021-488...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +98 more potentially affected by CVE-2021-29552 via tensorflow-cpu (>=1.15.0 <=2.2.0)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.0.1, =0.3.3 and more Source cves: CVE-2021-29552 Source advisory: OSV:PYSEC-2021-480...

8x8: Subdomain takeover of ████.jitsi.net

Summary █████.jitsi.net points to an AWS EC2 instance at 18.195.93.116 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing ...

Important Photon OS Security Update - PHSA-2021-0237

Updates of 'linux-rt', 'linux-esx', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-3.0-0237

Updates of 'linux-aws', 'linux-esx', 'linux-secure', 'linux-rt', 'linux' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-4.0-0023

Updates of 'linux-aws', 'linux-esx', 'linux-secure', 'linux-rt', 'linux' packages of Photon OS have been released...

Ubuntu 21.04 : Linux kernel vulnerabilities (USN-4950-1)

The remote Ubuntu 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4950-1 advisory. Ryota Shiga discovered that the eBPF implementation in the Linux kernel did not properly verify that a BPF program only reserved as much memory for a ring...

USN-4946-1: Linux kernel vulnerabilities

It was discovered that the DRM subsystem in the Linux kernel contained double-free vulnerabilities. A privileged attacker could possibly use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-20292 Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan ...

CVE-2021-25736

A flaw was found in the Windows kube-proxy component. In a cloud environment that does not set the “.status.loadBalancer.ingress.ip” field in the LoadBalancer service status configuration for example in AWS the packets can be misrouted and reach an unintended destination...

USN-4945-1: Linux kernel vulnerabilities

It was discovered that the Nouveau GPU driver in the Linux kernel did not properly handle error conditions in some situations. A local attacker could use this to cause a denial of service system crash. CVE-2020-25639 Jan Beulich discovered that the Xen netback backend in the Linux kernel did not...

AWS CloudShell Terminal Escape Injection / Remote Code Execution Vulnerabilities

The javascript terminal emulator used by AWS CloudShell handles certain terminal escape codes incorrectly. This can lead to remote code execution if attacker controlled data is displayed in a CloudShell instance. Terminal escape injection in AWS CloudShell The javascript terminal emulator used by...

AWS CloudShell Terminal Escape Injection / Remote Code Execution

Terminal escape injection in AWS CloudShell The javascript terminal emulator used by AWS CloudShell handles certain terminal escape codes incorrectly. This can lead to remote code execution if attacker controlled data is displayed in a CloudShell instance. The bug is in the handling of DCS escape...

Evernote: Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusion

Summary: The following endpoint was found to be vulnerable to SSRF : https://www.evernote.com/ro/aHR0cDovLzE2OS4yNTQuMTY5LjI1NC8jdGVzdC5qcw==/-1430533899.js The endpoint take a path in url and retrieve its content. it is supposed to be use on path but it can be used on URL to get access to intern...

Red-Detector - Scan Your EC2 Instance To Find Its Vulnerabilities Using Vuls.io

Scan your EC2 instance to find its vulnerabilities using Vuls https://vuls.io/en/. Audit your EC2 instance to find security misconfigurations using Lynis https://cisofy.com/solutions/lynis. Scan your EC2 instance for signs of a rootkit using Chkrootkit http://www.chkrootkit.org/. Requirements 1...