Input validation

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

CVE-2012-3427

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

CVE-2012-3427

CVE-2012-3427 affects Red Hat’s Red Hat Enterprise Linux 6 on EC2 with the JBoss Enterprise Application Platform 5.1.2 EC2 AMI. The issue is that /var/cache/jboss-ec2-eap/ had world-readable permissions (part of the 755 mode), allowing local users to read potentially sensitive data such as AWS cr...

AWS Elastic Beanstalk Code Execution

Form:http://en.wooyun.org/bugs/wooyun-2013-040 Abstract£º AWS Elastic Beanstalk is an even easier way for you to quickly deploy and manage applications in the AWS cloud. elasticbeanstalk subdomain exists Struts2 code execution . Details£º poc return /ok:...

[SECURITY] Fedora 18 Update: eucalyptus-3.2.2-1.fc18

Eucalyptus is a service overlay that implements elastic computing using existing resources. The goal of Eucalyptus is to allow sites with existing clusters and server infrastructure to co-host an elastic computing service that is interface-compatible with Amazon AWS. This package contains the...

Amazon Web Services, aws_portal / remote code execution

awsportal is a tool to Create new AWS instances, volumes for QA and Development purposes with the help of the AWS APIs, all in real-time. this tool has a file which is vulnerable to remote code execution link to source : https://github.com/ejlax/rsportal/ file rs-api-start.php uses getparameter...

Amazon Linux AMI : bind (ALAS-2013-214)

A denial of service flaw was found in BIND. A remote attacker could use this flaw to send a specially crafted DNS query to named that, when processed, would cause named to crash when rejecting the malformed query. CVE-2013-4854 C Tenable Network Security, Inc. The descriptive text and package...

[Nimbostratus] Tools for fingerprinting and exploiting Amazon cloud infrastructures

Nimbostratus are tools for fingerprinting and exploiting Amazon cloud infrastructures. Nimbostratus is the first toolset to help you in the process of pivoting in Amazon AWS clouds Features Enumerate permissions to AWS services for current IAM role Use poorly configured IAM role to create new AWS...

Fedora Update for nodejs-aws-sign FEDORA-2013-11780

Check for the Version of nodejs-aws-sign OpenVAS Vulnerability Test Fedora Update for nodejs-aws-sign FEDORA-2013-11780 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modif...

Fedora Update for nodejs-aws-sign FEDORA-2013-11780

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 18 Update: nodejs-aws-sign-0.3.0-1.fc18

Simple module to calculate Authorization header for Amazon AWS REST request s...

Path Traversal in AWS XMS

Advisory ID: HTB23147 Product: AWS XMS Vendor: http://www.aws-dms.com Vulnerable Versions: 2.5 and probably prior Tested Version: 2.5 Vendor Notification: March 6, 2013 Vendor Patch: March 16, 2013 Public Disclosure: March 27, 2013 Vulnerability Type: Path Traversal CWE-22 CVE Reference:...

AWS Xms 2.5 - importer.php?what Directory Traversal

AWS Xms 2.5 - importer.php?what Directory Traversal Advisory ID: HTB23147 Product: AWS XMS Vendor: http://www.aws-dms.com Vulnerable Versions: 2.5 and probably prior Tested Version: 2.5 Vendor Notification: March 6, 2013 Vendor Patch: March 16, 2013 Public Disclosure: March 27, 2013 Vulnerability...

AWS Xms 2.5 - 'importer.php?what' Directory Traversal

Advisory ID: HTB23147 Product: AWS XMS Vendor: http://www.aws-dms.com Vulnerable Versions: 2.5 and probably prior Tested Version: 2.5 Vendor Notification: March 6, 2013 Vendor Patch: March 16, 2013 Public Disclosure: March 27, 2013 Vulnerability Type: Path Traversal CWE-22 CVE Reference:...

Fedora Update for eucalyptus FEDORA-2013-3498

Check for the Version of eucalyptus OpenVAS Vulnerability Test Fedora Update for eucalyptus FEDORA-2013-3498 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

[SECURITY] Fedora 18 Update: eucalyptus-3.2.1-2.fc18

Eucalyptus is a service overlay that implements elastic computing using existing resources. The goal of Eucalyptus is to allow sites with existing clusters and server infrastructure to co-host an elastic computing service that is interface-compatible with Amazon AWS. This package contains the...

AWS XMS 2.5 Path Traversal

Advisory ID: HTB23147 Product: AWS XMS Vendor: http://www.aws-dms.com Vulnerable Versions: 2.5 and probably prior Tested Version: 2.5 Vendor Notification: March 6, 2013 Vendor Patch: March 16, 2013 Public Disclosure: March 27, 2013 Vulnerability Type: Path Traversal CWE-22 CVE Reference:...

[SECURITY] Fedora 17 Update: euca2ools-2.1.3-1.fc17

Euca2ools are command line tools used to interact with Eucalyptus, a service overlay designed to be interface-compatible with Amazon Web Services AWS, as well as AWS itself...

[SECURITY] Fedora 18 Update: euca2ools-2.1.3-1.fc18

Euca2ools are command line tools used to interact with Eucalyptus, a service overlay designed to be interface-compatible with Amazon Web Services AWS, as well as AWS itself...

Path Traversal in AWS XMS

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in AWS XMS, which can be exploited to read contents of arbitrary files. 1 Path Traversal in AWS XMS: CVE-2013-2474 The vulnerability exists due to insufficient filtration of "what" HTTP GET parameter passed to...