Arbitrary Command Injection

aws-lambda is vulnerable to arbitrary command injection. The vulnerability exists due to the lack of sanitization on the value of config.FunctionName, allowing injection payloads to reach the exec function...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

Design/Logic Flaw

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

CVE-2019-10777

CVE-2019-10777 affects aws-lambda prior to v1.0.5. The vulnerability arises because config.FunctioName is used to assemble the argument for exec without sanitization, enabling an attacker to inject arbitrary commands into the zipCmd executed via config.FunctionName. Impact ranges from partial to ...

Ubuntu: Security Advisory (USN-4228-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Command Injection

Overview aws-lambda is a command line tool deploy code to AWS Lambda. Affected versions of this package are vulnerable to Command Injection. The config.FunctioName is used to construct the argument used within the exec function without any sanitization. It is possible for a user to inject arbitra...

ec2-52-36-45-12.us-west-2.compute.amazonaws.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1057603 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

console.aws.opennetworkexchange.net Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1052049 Security Researcher Fadavvi Helped patch 80 vulnerabilities Received 4 Coordinated Disclosure badges Received 1 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

aws.computerstudi.es Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1051779 Security Researcher Trarz Helped patch 8 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting aws.computerstudi.es website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the...

Serverless ETLs? Easy Data Lake Transformations using AWS Athena

In a data lake raw data is added with little or no processing, allowing you to query it straight away. This gives you a great way to learn about your data - whether it represents a quick win or a fast fall. However, there are two disadvantages: performance and costs. If, for example you added CSV...

Cloud Template Tool – The only way for Imperva On-Premises deployment on AWS

For the last six years, Imperva’s customers have been able to deploy our On-Premises product on AWS and enjoy the many advantages of cloud deployment including flexibility, cost-effectiveness, scalability, accessibility and many others. But using Imperva On-Premises on AWS wasn’t always easy, and...

Lousy IoT Security

DTEN makes smart screens and whiteboards for videoconferencing systems. Forescout found that their security is terrible: In total, our researchers discovered five vulnerabilities of four different kinds: Data exposure: PDF files of shared whiteboards e.g. meeting notes and other sensitive files...

“The default account is not initialized” error is displayed when adding an IAM role to Veeam Backup for AWS

Challenge The Default Backup Restore IAM role is not created upon the Veeam Backup for AWS installation. Attempts to add IAM roles to Veeam Backup for AWS in the Add Account wizard fail with the error: The default account is not initialized Cause The backup server cannot access the required AWS...

How We Streamlined Infrastructure and Tooling as a Service for Development

At VMware Carbon Black, we’ve historically acquired a broad technology stack in our journey to build the premier security solution that understands cybercriminal behavior. Inheriting such a variety of tooling and storage solutions presented a challenge for us operationally. So, in order to reduce...

TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server Information Disclosure Vulnerability

TIBCO Spotfire Analytics Platform for AWS Marketplace is a data visualization and analytics platform for the AWS Marketplace, an online software store.TIBCO Spotfire Server is an intelligent, secure, flexible, and scalable tool that provides data visualization , discovery, organizing and predicti...

TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server Information Disclosure Vulnerability (CNVD-2020-12703)

TIBCO Spotfire Analytics Platform for AWS Marketplace is a data visualization and analytics platform for the AWS Marketplace, an online software store.TIBCO Spotfire Server is an intelligent, secure, flexible, and scalable tool that provides data visualization , discovery, organizing and predicti...

CVE-2019-17337

The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting XSS attack. Affected releases are TIBCO Software Inc.'...

CVE-2019-17335

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacke...