5176 matches found
CVE-2018-5431
Removed by vendor...
CVE-2018-5429
Removed by vendor...
AWS Pwn - A Collection Of AWS Penetration Testing Junk
This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please feel free to...
Denial Of Service (DoS)
AWS SDK for IOS is vulnerable to denial of service DoS attacks. The library does not validate several memory allocations in multiple functions, causing the application to crash...
CloudFrunt - A Tool For Identifying Misconfigured CloudFront Domains
CloudFrunt is a tool for identifying misconfigured CloudFront domains. Background CloudFront is a Content Delivery Network CDN provided by Amazon Web Services AWS. CloudFront users create "distributions" that serve content from specific sources an S3 bucket, for example. Each CloudFront...
goGetBucket - A Penetration Testing Tool To Enumerate And Analyse Amazon S3 Buckets Owned By A Domain
When performing a recon on a domain - understanding assets they own is very important. AWS S3 bucket permissions have been confused time and time again, and have allowed for the exposure of sensitive material. What this tool does, is enumerate S3 bucket names using common patterns I have identifi...
Ubuntu: Security Advisory (USN-3619-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-3619-2: Linux kernel (Xenial HWE) vulnerabilities
USN-3619-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jann Horn discovered that the Berkeley Packet Filter BPF implementation in the Linux...
UPDATE: Prowler 2.0 Beta
PenTestIT RSS Feed My older post about Prowler was about a good NINE months ago. Since then, a lot has changed and hence, this post is about the recently released update made to the AWS CIS Benchmark tool – Prowler 2.0 Beta! This new beta version has lots of improvements which you shall read abou...
USN-3619-1: Linux kernel vulnerabilities
Jann Horn discovered that the Berkeley Packet Filter BPF implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2017-16995 It was discovered that a...
Identify Misconfigured CloudFront Domains: CloudFrunt
CloudFrunt is a tool for identifying misconfigured CloudFront domains. CloudFront is a Content Delivery Network CDN provided by Amazon Web Services AWS. CloudFront users create “distributions” that serve content from specific sources an S3 bucket, for example. Each CloudFront distribution has a...
Important Photon OS Security Update - PHSA-2018-0033
Updates of 'linux', 'linux-esx', 'linux-aws', 'linux-secure' packages of Photon OS have been released...
aws.golf-club-baden-baden.de XSS vulnerability
Open Bug Bounty ID: OBB-594340 Description| Value ---|--- Affected Website:| aws.golf-club-baden-baden.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2016-0898
MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...
Design/Logic Flaw
MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...
CVE-2016-0898
CVE-2016-0898 affects MySQL for PCF tiles 1.7.x prior to 1.7.10. The issue is that AWS access keys were logged in plaintext to the Service Backup component logs (not the system logs), within the Service Backup VM. The public disclosures indicate credential leakage via internal logs, not exfiltrat...
CVE-2016-0898
MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...
HashiCorp Terraform Amazon Web Services provider fixed password generation vulnerability
HashiCorp Terraform Amazon Web Services AWS provider is a program for interacting with AWS supported resources. A security vulnerability exists in the aws/resourceawsiamuserloginprofile.go file in HashiCorp Terraform AWS provider version 1.12.0 and earlier. A remote attacker can exploit this...
