CVE-2022-36022

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use...

CVE-2022-36022 Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use...

PT-2022-23121 · Unknown · Deeplearning4J

Name of the Vulnerable Software and Affected Versions: Deeplearning4J versions through 1.0.0-M2.1 Description: The issue affects users of older NLP examples that reference an old S3 bucket. The problem arises from the use of some unclaimed S3 buckets in tests and examples. The estimated number of...

CVE-2022-36022

CVE-2022-36022 affects Deeplearning4J up to version 1.0.0-M2.1, where certain tests and examples (packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests) may reference unclaimed S3 buckets. Root cause: tests and NLP example code referencing old, unowned S3 storage. Report...

Virtuozzo Hybrid Infrastructure 5.3 (5.3.0-130)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover Kubernetes as a Service, storage performance, security, monitoring and alerts, and the user interface. Additionally, this release delivers stability improvements and addresses issues found in previous...

CVE-2022-39281

fatfreecrm is a an open source, Ruby on Rails customer relationship management platform CRM. In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit "c85a254" and will be...

CVE-2022-39281 Remote Denial of Service via Tasks endpoint in fat_free_crm

fatfreecrm is a an open source, Ruby on Rails customer relationship management platform CRM. In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit c85a254 and will be...

CVE-2022-39281: Improper Input Validation

fatfreecrm is a an open source, Ruby on Rails customer relationship management platform CRM. In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit c85a254 and will be...

Fat Free CRM 输入验证错误漏洞

Fat Free CRM is an open source Ruby on Rails based customer relationship management platform. The platform includes modules for team collaboration, customer management, contact lists, customer tracking and more. Fat Free CRM Prior to version 0.20.1 An input validation error vulnerability exists,...

S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2022-057

This module enables you to utilize S3-compatible storage as a Drupal filesystem. The module doesn't sufficiently prevent file access across multiple filesystem schemes stored in the same bucket. This vulnerability is mitigated by the fact that an attacker must obtain a method to access arbitrary...

GHSA-5FFJ-MPH5-C5HV Appwrite Vulnerable to Cross-site Scripting

Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names...

Appwrite Vulnerable to Cross-site Scripting

Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names...

Malicious Package

Overview middleware-bucket-endpoint is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

XSS with CSP bypass on WEB instances

📝 Description Drawio WEB instancesn allows https://storage.googleapis.com in CSP script-src, abusing the XSS found in this report, it is possible to bypass the CSP and leak private diagram content. 🕵️‍♂️ Proof of Concept On the web application side, the javascript execution is protected by the...

TerraformGoat - "Vulnerable By Design" Multi Cloud Deployment Tool

TerraformGoat is selefra research lab's "Vulnerable by Design" multi cloud deployment tool. Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure. Scenarios ID | Cloud Service Company | Types Of Cloud...

Path Traversal

aws-java-sdk-s3 is vulnerable to path traversal. The vulnerability exists due to the insufficient guard logic used for the download directory in the leavesRoot function of TransferManager.java, allowing an attacker to access files from the S3 bucket that is one level up in the file system by...

[Bypass] Cross-site Scriptin (XSS) via file upload

🔒️ Requirements Privileges: User. 📝 Description I found a bypass to this report by uploading the file with "public": true, parameter. This is due to the fact that AWS bucket public folder does not auto download files when we access them. 🕵️‍♂️ Proof of Concept Step 1: Go your outline home and...

Partial Path Traversal in com.amazonaws:aws-java-sdk-s3

Overview A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java v1. Applications using the SDK control the destinationDirectory argument, but S3 object keys are determined by the application that uploaded the...

PT-2022-20574

Name of the Vulnerable Software and Affected Versions AWS SDK for Java versions prior to 1.12.261 Description A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java. This issue allows a knowledgeable actor to bypas...

CVE-2022-22997

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices...