Critical Photon OS Security Update - PHSA-2022-0356

Updates of 'linux-aws', 'linux-secure', 'linux-esx', 'polkit', 'glibc', 'openssh', 'linux-rt', 'linux', 'vim' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0146

Updates of 'linux-aws', 'linux-secure', 'pkg-config', 'linux-rt', 'linux', 'linux-esx' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0146

Updates of 'linux-esx', 'linux-aws', 'pkg-config', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0433

Updates of 'linux-esx', 'linux', 'linux-aws', 'linux-secure' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2022-4.0-0145

Updates of 'cryptsetup', 'linux-esx', 'expat', 'wireshark', 'linux-aws', 'systemd', 'aide', 'ImageMagick', 'linux', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

How to use "Restore to Amazon EC2" via AWS PrivateLink / Direct Connect

Purpose This article documents how to configure Veeam Backup & Replication to use AWS PrivateLink or AWS Direct Connect to perform Restore to Amazon EC2. This restore configuration also works when the Veeam Backup server has restricted or no public internet access. Region Modification Limitation...

Medium: aws-kinesis-agent

Issue Overview: Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC...

7Rapid Questions: Stephen Donnelly

At Rapid7, there's no shortage of passionate leaders looking to challenge convention and make an impact. Our "7Rapid Questions" series is a way to highlight some of the amazing work taking place behind the scenes, and the exciting growth opportunities available in our global offices. For this...

Important Photon OS Security Update - PHSA-2022-3.0-0351

Updates of 'linux-aws', 'linux', 'linux-secure', 'linux-esx', 'linux-rt' packages of Photon OS have been released...

JetBlue: Sensitive information disclosure on grafana

Sensitive information was disclosed through publicly accessible Grafana metrics, SAP public info endpoints, and an AWS bucket listing...

CVE-2021-35500

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

Design/Logic Flaw

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

CVE-2021-35500 TIBCO Data Virtualization Arbitrary File Download vulnerability

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

CVE-2021-35500

CVE-2021-35500 affects TIBCO Data Virtualization: Data Virtualization Server. The vulnerability enables a low-privilege, local attacker to download arbitrary files outside the user’s permissions due to insufficient access controls on the file download feature. Affected releases: TIBCO Data Virtua...

Hackers Use Cloud Services to Distribute Nanocore, Netwire, and AsyncRAT Malware

Threat actors are actively incorporating public cloud services from Amazon and Microsoft into their malicious campaigns to deliver commodity remote access trojans RATs such as Nanocore, Netwire, and AsyncRAT to siphon sensitive information from compromised systems. The spear-phishing attacks, whi...

3.7M FlexBooker Records Dumped on Hacker Forum

A threat group that identifies itself as Uawrongteam is dumping data stolen from FlexBooker – a popular online appointment scheduling tool for booking services ranging from counseling to haircuts – on a cybercriminal forum. FlexBooker sent a notification to its users, explaining that its Amazon A...

@aws/nx-plugin (>=0.79.1, <=0.93.1), @gpx/dan (>=1.1.0, <=1.2.0) +34 more potentially affected by CVE-2020-28500 via lodash.trim (4.5.1)

lodash.trim NPM version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on lodash.trim and may be impacted: - @aws/nx-plugin =0.79.1, =1.1.0, =0.0.1, =1.6.1, =0.0.1, =1.4.6, =2.4.0, =1.2.0, =1.2.6, =1.5.7, =3.6.0, =7.0.3, =1.7.0, =1.9.6, =3.0.2 and...

USN-5210-1: Linux kernel vulnerabilities

Nadav Amit discovered that the hugetlb implementation in the Linux kernel did not perform TLB flushes under certain conditions. A local attacker could use this to leak or alter data from other processes that use huge pages. CVE-2021-4002 It was discovered that the Linux kernel did not properly...

USN-5208-1: Linux kernel vulnerabilities

Nadav Amit discovered that the hugetlb implementation in the Linux kernel did not perform TLB flushes under certain conditions. A local attacker could use this to leak or alter data from other processes that use huge pages. CVE-2021-4002 It was discovered that a race condition existed in the...

Workshop: Building Modern Applications with DevOps Security

In this workshop, you’ll learn how to leverage DevOps Security with your serverless applications running on AWS Lambda or containerized applications running on AWS Fargate. Learn how to make cloud security more efficient, proactive, and gain visibility...