Internet Bug Bounty: Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket

A misconfiguration in the AWS CloudFront CDN configuration for rubygems.org caused content to be served from an unclaimed S3 bucket. This could have enabled an attacker to serve malicious content and affect availability. Artifactory instances were observed accessing files, presenting a potential...

CVE-2023-6017

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

CVE-2023-6017

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

Code injection

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

CVE-2023-6017

CVE-2023-6017 concerns H2O with a reference to an S3 bucket that no longer exists, which could allow an attacker to take over the S3 bucket URL. The connected sources (NVD/Red Hat/PRION-like records) confirm the same vulnerability description across multiple feeds, indicating an issue where an ou...

CVE-2023-6017 H2O S3 Bucket Takeover

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

H2O Security Breach

H2O is an in-memory platform for distributed, scalable machine learning. H2O suffers from a security vulnerability that stems from allowing an unauthorized attacker to access the S3 bucket and execute remote code...

CVE-2023-6017: Undefined Security Weakness

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

S3 Bucket can lead to spread of malicious R package

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

PT-2023-32480

Name of the Vulnerable Software and Affected Versions H2O affected versions not specified Description The issue allows an attacker to take over an S3 bucket URL due to a reference to a non-existent S3 bucket. Recommendations At the moment, there is no information about a newer version that contai...

OESA-2023-1761 ceph security update

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage. Security Fixes: A flaw was found in rgw. This flaw allows an unprivileged user to write to any buckets accessible by a given key if a POST's...

CVE-2023-45279

Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...

CVE-2023-45280

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...

CVE-2023-45279

Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...

CVE-2023-45280

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...

Design/Logic Flaw

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...

Design/Logic Flaw

Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...

CVE-2023-45277

Yamcs 5.8.6 is vulnerable to directory traversal issue 1 of 2. The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files...

Yamcs Cross-Site Scripting Vulnerability

Yamcs is an open source software framework from Yamcs Open Source. It is used to command and control spacecraft, satellites, payloads, ground stations and ground equipment. A security vulnerability exists in Yamcs version 5.8.6, which stems from the fact that it is possible to upload a display...

PT-2023-29482 · Yamcs · Yamcs

Name of the Vulnerable Software and Affected Versions: Yamcs version 5.8.6 Description: The issue allows for Cross-Site Scripting XSS attacks. It comes with a Bucket as its primary storage mechanism, which allows for the upload of any file. There's a way to upload a display referencing a maliciou...