PT-2025-25352

Name of the Vulnerable Software and Affected Versions Amazon Cloud Cam affected versions not specified Description The issue concerns a home security camera that is no longer supported due to its end-of-life status. When powered on, the device attempts to connect to a deprecated remote service...

MAL-2025-374 Malicious code in amazon-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4b71318a5323c17de18f5573bc2c87a70f80ec6de2577c55c243993d76da1f51 The OpenSSF Package Analysis project identified 'amazon-cloud' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4b71318a5323c17de18f5573bc2c87a70f80ec6de2577c55c243993d76da1f51 The OpenSSF Package Analysis project identified 'amazon-cloud' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

UBUNTU-CVE-2023-4237

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availabili...

CVE-2023-0423

The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

DEBIAN-CVE-2022-2582

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...

Amazon AWS competition conditions issue vulnerabilities

Amazon AWS is a cloud computing platform from the U.S.-based Amazon.com that provides a range of services including information technology infrastructure and applications, such as storage, databases, computing, machine learning, and more, to individuals, businesses, and governments. A security...

TrueStack Direct Connect security vulnerability

TrueStack Direct Connect is a VPN management server from TrueStack USA, Inc. for easily connecting Windows and Mac computers to Windows domain controllers and file servers in the AWS cloud. A security vulnerability exists in TrueStack Direct Connect 1.4.7 that stems from incorrect application...

HTCondor log information leakage vulnerability

HTCondor is a workload management system at the University of Wisconsin-Madison USA. The system provides job queuing mechanisms, scheduling policies, prioritization schemes, resource monitoring and resource management. A security vulnerability exists in HTCondor versions 9.0.x through 9.0.10 and...

CVE-2021-20077

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token...

Ansible: modules which use files encrypted with vault are not properly cleaned up

A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, wincopy, awss3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root...

L'Oréal L'Oréal Finance app has unauthorized access vulnerability

L'Oréal Finance app is the news app of L'Oréal Group, which allows users to browse the latest L'Oréal Group financial information in English and French on L'Oréal Finance. An unauthorized access vulnerability exists in the L'Oréal L'Oréal Finance app. An attacker could exploit the vulnerability t...

When Security Researchers Pose as Cybercrooks, Who Can Tell the Difference?

A ridiculous number of companies are exposing some or all of their proprietary and customer data by putting it in the cloud without any kind of authentication needed to read, alter or destroy it. When cybercriminals are the first to discover these missteps, usually the outcome is a demand for mon...

Free High-Tech Bridge ImmuniWeb Application Discovery service

Today I would like to talk about another service for application security analysis by High-Tech Bridge. It's called ImmuniWeb Application Discovery. This service can get information about your web and mobile applications available from the Internet. Believe me, this is not so obvious for a large...

Amazon Cloud Music Player Detection

Binary data 9274.prm...

Amazon Cloud Music Player Detection

Binary data 9273.prm...

Amazon Cloud Music Player Detection

Binary data 9359.prm...

Amazon Cloud Drive - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Amazon Cloud Drive published at the 'play' market has multiple vulnerabilities...

Amazon Cloud Login Detection (deprecated)

Binary data 8874.prm...

Firefox bookmarks extensions apps Pocket: vulnerability mining not so difficult-vulnerability warning-the black bar safety net

The Pocket application's developers recently fixed a few leaked data a vulnerability, hackers may be from the server to obtain WEB Services, internal IP address, as well as more sensitive information. Pocket profile Pocket formerly known as Read it Later, as the name suggests, is an online...