PT-2024-5257 · Amazon · Aws S3

Name of the Vulnerable Software and Affected Versions: Open edX Platform versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper Description: The issue is related to inadequate access control in the Open edX Platform, specifically with the AWS S3 Bucket Handler component. This may all...

CVE-2024-41806: Improper Access Control

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

Malicious code in sap-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9012927afba575f7238a84997d4c3987b6dfa74ec9e0bd0c1a1535eeffa6298f The OpenSSF Package Analysis project identified 'sap-bucket' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7634 Malicious code in sap-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9012927afba575f7238a84997d4c3987b6dfa74ec9e0bd0c1a1535eeffa6298f The OpenSSF Package Analysis project identified 'sap-bucket' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

The vulnerability of the BNbin2bn function (etc/uams/uams_dhx_pam.c) in the implementation of the Apple File Protocol Netatalk allows a hacker to cause a service failure.

The vulnerability of the BNbin2bn function etc/uams/uamsdhxpam.c in the implementation of the Apple File Protocol Netatalk protocol is related to buffer overflow in the “bucket” component. Exploiting this vulnerability can allow an attacker to trigger a service failure through the FPLoginExt...

The vulnerability of WebAudio elements in browsers such as Google Chrome and Microsoft Edge allows attackers to execute arbitrary code.

The vulnerability of WebAudio elements in Google Chrome and Microsoft Edge is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

MAL-2024-6968 Malicious code in lita_onewheel-beer-tin-bucket (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lita_onewheel-beer-tin-bucket (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

The vulnerability of the Tab Strip control elements in Microsoft Edge and Google Chrome browsers allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the Tab Strip control elements in Microsoft Edge and Google Chrome is related to buffer overflows in the “bucket” mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by using a specially created HTML page...

Error: could not get determine if bucket supports versioning: Access Denied

Challenge Veeam Kasten for Kubernetes is unable to monitor or refresh the retention period of the data in the S3 bucket and cannot calculate the lock duration based on your retention setting because of this issue. This will show up as an error message in the notification bar: error: can't connect...

SUSE CVE-2022-31159

The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the...

minio -- unintentional information disclosure

Minio security advisory GHSA-95fr-cm4m-q5p9 reports: when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information...

AZL-40646 CVE-2023-43040 affecting package ceph for versions less than 16.2.10-4

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...

DEBIAN-CVE-2023-43040

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...

CVE-2023-43040: Insufficient Granularity of Access Control

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...

Security Bulletin: IBM Storage Fusion HCI is vulnerable to unauthorized access due to a flaw in Ceph RGW.

Summary Ceph is used by IBM Storage Fusion HCI if IBM Storage Fusion HCI is configured with the Data Foundation service. CVE-2023-43040. Vulnerability Details CVEID:CVE-2023-43040 DESCRIPTION: IBM Spectrum Fusion HCI could allow an attacker to perform unauthorized actions in RGW for Ceph due to...

IBM: S3 Bucket Takeover on apptio endpoint

The S3 bucket takeover vulnerability on the Apptio endpoint was reported, analyzed, and remediated. The external researcher who discovered the issue was thanked...

SUSE CVE-2024-34483

OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via OFPBucket.len=0...

The vulnerability of Adobe Audition’s audio editor lies in the overflowing buffer in the “bucket,” allowing a hacker to execute arbitrary code.

The vulnerability of Adobe Audition is related to overflowing buffers in the “bucket” mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

PT-2024-25934

Name of the Vulnerable Software and Affected Versions Faucet SDN Ryu version 4.34 Description The issue allows attackers to cause a denial of service infinite loop via OFPBucket.len=0 in OFPGroupDescStats in parser.py. Recommendations For version 4.34, consider disabling the OFPGroupDescStats...