5524 matches found
Aaia - AWS Identity And Access Management Visualizer And Anomaly Finder
Aaia pronounced as shown here helps in visualizing AWS IAM and Organizations in a graph format with help of Neo4j. This helps in identifying the outliers easily. Since it is based on neo4j , one can query the graph using cypher queries to find the anomalies. Aaia also supports modules to...
prd-medweb-cdn.s3.amazonaws.com Improper Access Control vulnerability
Security Researcher NotAkay Helped patch 1 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting prd-medweb-cdn.s3.amazonaws.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard...
How we Developed a Unified Binary Store (UBS): Part 1
Like most technology companies, VMware Carbon Black has a combination of acquired and built technologies that all utilize their own data stores. As our products have evolved to include the benefits of a centralized cloud offering, our data stores needed to similarly evolve. A new goal was formed:...
CVE-2020-2091
A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...
CVE-2020-2090
A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...
Security feature bypass
A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...
Cross site request forgery (csrf)
A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...
CVE-2020-2090
The CVE-2020-2090 entry pertains to a CSRF vulnerability in Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). The root cause is that form validation methods did not perform permission checks, allowing users with Overall/Read access to Jenkins to connect to an attacker-specified URL within th...
CVE-2020-2091
CVE-2020-2091 concerns the Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). A missing permission check in form validation allows users with Overall/Read access to connect to an attacker-specified URL in the AWS region using attacker-specified credentials IDs obtained via another method. The...
Razer: Aws bucket writable mobile.razer.com
The tester discovered an S3 bucked owned by Mobile that was writeable. No files were present but the permissions were incorrect and subsequently fixed. Razer appreciates the report...
Arbitrary Command Injection
aws-lambda is vulnerable to arbitrary command injection. The vulnerability exists due to the lack of sanitization on the value of config.FunctionName, allowing injection payloads to reach the exec function...
CVE-2019-10777
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...
CVE-2019-10777
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...
Design/Logic Flaw
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...
CVE-2019-10777
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...
CVE-2019-10777
CVE-2019-10777 affects aws-lambda prior to v1.0.5. The vulnerability arises because config.FunctioName is used to assemble the argument for exec without sanitization, enabling an attacker to inject arbitrary commands into the zipCmd executed via config.FunctionName. Impact ranges from partial to ...
Ubuntu: Security Advisory (USN-4228-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
@xapp/stentor (>=1.13.9, <=1.15.0) potentially affected by CVE-2019-10777 via aws-lambda (>=1.0.0, <=1.0.4)
aws-lambda NPM version =1.0.0, =1.13.9, =1.15.0 Source cves: CVE-2019-10777 Source advisory: SNYK:JS-AWSLAMBDA-540839...
Command Injection
Overview aws-lambda is a command line tool deploy code to AWS Lambda. Affected versions of this package are vulnerable to Command Injection. The config.FunctioName is used to construct the argument used within the exec function without any sanitization. It is possible for a user to inject arbitra...
ec2-52-36-45-12.us-west-2.compute.amazonaws.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1057603 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...