Important Photon OS Security Update - PHSA-2021-3.0-0234

Updates of 'linux', 'linux-esx', 'linux-secure', 'linux-rt', 'linux-aws' packages of Photon OS have been released...

CVE-2021-32020

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory...

Over 40 Apps With More Than 100 Million Installs Found Leaking AWS Keys

Most mobile app users tend to blindly trust that the apps they download from app stores are safe and secure. But that isn't always the case. To demonstrate the pitfalls and identify vulnerabilities on a large scale, cybersecurity and machine intelligence company CloudSEK recently provided a...

Zomato: Subdomain takeover of fr1.vpn.zomans.com

Summary fr1.vpn.zomans.com points to an AWS EC2 instance at 52.47.57.107 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointin...

Zego: Subdomain takeover of v.zego.com

Summary v.zego.com points to an AWS EC2 instance at 52.214.138.192 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing to...

Photon OS 4.0: Linux PHSA-2021-4.0-0013

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0013. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid149053...

Palo Alto Software: Subdomain takeover of www2.growasyouplan.com

Summary www2.growasyouplan.com points to an AWS EC2 instance at 67.202.62.93 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are...

U.S. Dept Of Defense: S3 bucket listing/download

It's possible to get a listing and download every file in the S3 bucket ██████████ and ███████ . Supporting Material/References https://hackerone.com/reports/278191 Impact An attacker can download files that are not intended to be public, both buckets are very big. An attacker can increase...

Integer overflow

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in streambuffer.c for a stream buffer...

CVE-2021-31572

CVE-2021-31572 affects Amazon FreeRTOS kernel prior to 10.4.3. The issue is an integer overflow in stream_buffer.c within the stream buffer code, which can lead to memory-related issues on affected devices. The vulnerability has a high severity (CVSS v3.1 base score 9.8, network attack, no user i...

CVE-2021-31571

CVE-2021-31571 affects Amazon FreeRTOS prior to 10.4.3, where an integer overflow in queue.c during queue creation can lead to memory corruption. Red Hat and CNVD entries corroborate the same vulnerability in AWS FreeRTOS. The issue is rooted in queue creation logic; the impact is memory corrupti...

CVE-2021-31571

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation...

Overlord - Red Teaming Infrastructure Automation

Overlord provides a python-based console CLI which is used to build Red Teaming infrastructure in an automated way. The user has to provide inputs by using the tool’s modules e.g. C2, Email Server, HTTP web delivery server, Phishing server etc. and the full infra / modules and scripts will be...

Important Photon OS Security Update - PHSA-2021-0221

Updates of 'linux-rt', 'linux-esx', 'rpm', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-0011

Updates of 'linux-aws', 'linux-secure', 'linux-rt', 'linux', 'linux-esx' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-3.0-0221

Updates of 'linux', 'linux-esx', 'linux-secure', 'linux-rt', 'rpm', 'linux-aws' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-4.0-0011

Updates of 'linux', 'linux-esx', 'linux-secure', 'linux-rt', 'linux-aws' packages of Photon OS have been released...

SUSE: Security Advisory (SUSE-SU-2020:0555-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Codecov Discloses Supply Chain Compromise

The following blog was co-authored by Curt Barnard and Caitlin Condon. On April 15, 2021, code coverage and testing company Codecov announced a supply chain compromise in which a malicious party gained access to their Bash Uploader script and modified it without authorization, enabling the...

USN-4917-1: Linux kernel vulnerabilities

It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. CVE-2021-3493 Vincent Dehors discovered that the shiftfs file...