Fedora: Security Advisory for mass3 (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: mass3-0-0.6.20200627gite1d5f1a.fc36

Quickly enumerate through a pre-compiled list of AWS S3 buckets using DNS instead of HTTP with a list of DNS resolvers and multi-threading...

Stored xss in "users name","functions name","storage buckets name" and in "database collections name"

Description Appwrite application allows malicious javascript payload to inject in users name,functions name,storage buckets name and in database collections name which leads to Stored XSS. Proof of Concept 1.Login to the application 2.Go to the "users name","functions name","storage buckets name"...

PT-2022-21370

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 7.0.4 Description An issue in Couchbase Server may leak internal user passwords during a failure when loading sample buckets. Recommendations For versions prior to 7.0.4, update to version 7.0.4 or later to...

Slyther - AWS Security Tool

Slyther is AWS Security tool to check read/write/delete access for S3 buckets Requirements aws-cli Installation pip3 install -r requirements.txt Usage example python3 slyther.py -b flaws.cloud Release History 0.0.3 Added option to check if aws-cli is installed or not 0.0.2 Added option to check...

Kubernetes: File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow

A vulnerability was found in AWS Prow that allowed attackers to sign the base path of S3 buckets used by Prow, leading to the dumping of the entire private bucket details and reading any file in the bucket. This could result in the compromise of S3 buckets containing production data...

Google Cloud Storage Bucket Detected

Google Cloud Storage is a public cloud storage service available in Google Cloud Platform GCP which provides a programmatic way to store and retrieve data objects in storage containers called buckets. Web applications often rely on storage buckets to serve static assets images or scripts for...

Important: cyrus-imapd

Issue Overview: A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored in predictable buckets. A user may cause a CPU denial of service by maliciously directing many inputs to a single bucket. The highest threat from this...

cyrus-imapd: Denial of service via string hashing algorithm collisions

A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored in predictable buckets. A user may cause a CPU denial of service by maliciously directing many inputs to a single bucket. The highest threat from this vulnerability is to...

net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX NF_SYSCTL_CT_EXPECT_MAX and NF_SYSCTL_CT_BUCKETS sysctls.

...

Automated remediation level 4: Actual automation

Let’s get to automatically remediating already! This entry will be the last in our series based on The 4 Levels of Automated Remediation. After the previous 3 steps—where we discussed everything from logging to best practices to account hygiene—it’s time to talk about the actions that really let...

Security for Amazon Redshift

We’ll show you how to set up basic monitoring of AWS Redshift using their native security features, including how to set up a Redshift instance, creating S3 buckets, and shipping the audit logs to Cloudwatch. Basic security for Amazon Redshift can be accomplished through standard AWS security...

Securely Managing Entitlement of S3 Resources

Here we’ll talk about securely managing entitlements of S3 resources including managing access control to S3 objects and utilizing audit logging to keep track of the usage of shared resources. Amazon’s AWS services allow for accounts to grant access to resources from other accounts on AWS. This...

Nebula - Cloud C2 Framework, Which At The Moment Offers Reconnaissance, Enumeration, Exploitation, Post Exploitation On AWS

Nebula is a Cloud and hopefully DevOps Penetration Testing framework. It is build with modules for each provider and each functionality. As of April 2021, it only covers AWS, but is currently an ongoing project and hopefully will continue to grow to test GCP, Azure, Kubernetes, Docker, or...

PT-2021-28932

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.233 Description The issue is related to potential overflows in the nft hash buckets function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2021-28912

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.191 Description The issue is related to avoiding overflows in the nft hash buckets function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...

PT-2021-28876

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.120 Description The issue is related to potential overflows in the nft hash buckets function within the nftables component of the netfilter framework. The actual impact and attack plausibility have not yet...

PT-2021-28672

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.5 Description The issue is related to potential overflows in the nft hash buckets function within the nftables component of the netfilter framework. The actual impact and attack plausibility have not yet be...

PT-2021-28789

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.38 Description The issue is related to potential overflows in the nft hash buckets function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...

PT-2021-24795

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.38 Description The issue is related to potential overflows in the nft hash buckets function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...