5193 matches found
Enter the Vault: Authentication Issues in HashiCorp Vault
Posted by Felix Wilhelm, Project Zero Introduction In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services AWS and Google Cloud Platform GCP. These issues can lead to an authentication bypass in configurations that use the aws and gcp aut...
Black-T Malware Emerges From Cryptojacker Group TeamTNT
Researchers have discovered the latest cryptojacking malware gambit from TeamTNT, called Black-T. The variant builds on the group’s typical approach, with a few new — and sophisticated — extras. TeamTNT is known for its targeting of Amazon Web Services AWS credentials, to break into the cloud and...
CVE-2020-25635
A flaw was found in Ansible Base when using the awsssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality...
CVE-2020-25636
A flaw was found in Ansible Base when using the awsssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service...
CVE-2020-25636
A flaw was found in Ansible Base when using the awsssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service...
This One Time on a Pen Test: I Know...Everything
Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report. It...
Important Photon OS Security Update - PHSA-2020-3.0-0147
Updates of 'linux-esx', 'linux-aws', 'linux-secure', 'linux-rt', 'linux' packages of Photon OS have been released...
Cloud-y, with a chance of hacking all the wireless things
Grandstream are a provider of IP video and voice services, as well as Wi-Fi and other related services and equipment. Their products are sold in over 150 countries and they have offices around the globe. We were having a look at their GWN.Cloud management platform, used for remote device and...
U.S. Dept Of Defense: hardcoded password stored in javascript of https://████.mil
Summary: I have discovered a cleartext password stored within a javascript. This password allows me to authentication to https://█████.mil. Description: I have discovered a cleartext password stored within a javascript. This password allows me to authentication to https://███████.mil. To confirm...
USN-4527-1: Linux kernel vulnerabilities
It was discovered that the Conexant 23885 TV card device driver for the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service memory exhaustion. CVE-2019-19054 It was discovered that the Atheros HTC based wireless...
Moderate Photon OS Security Update - PHSA-2020-0144
Updates of 'linux-rt', 'linux-esx', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...
openSUSE Security Update : libmediainfo / mediainfo (openSUSE-2020-1390)
This update for libmediainfo, mediainfo fixes the following issues : libmediainfo was updated to version 20.08 : Added : - MPEG-H 3D Audio full featured support group presets, switch groups, groups, signal groups - MP4/MOV: support of more metadata locations - JSON and XML outputs: authorize...
Important Photon OS Security Update - PHSA-2020-0142
Updates of 'libxml2', 'cifs-utils', 'kubernetes', 'go', 'linux-rt', 'linux-esx', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...
This Week in Security News: AWS Outposts Ready Launches With 32 Validated Partners and Staples Hit by a Data Breach
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how solutions from 32 Amazon Web Services partners – including Trend Micro – are now available for AWS customers to use with the...
Release Information for Veeam Backup for AWS v2 Patch 1
Requirements You can check your build number under Configuration | Support Information | About | Server version by clicking the gear icon at the top-right corner of the main menu in Veeam Backup for AWS. After installing Veeam Backup for AWS v2 Patch 1, your build version will be 2.0.1.622...
Design/Logic Flaw
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim...
CVE-2020-9416 TIBCO Spotfire Stored Cross Site Scripting Vulnerability
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim...
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0283
An update of 'linux', 'linux-esx', 'linux-aws', 'linux-secure' packages of Photon OS has been released...