Shopify: S3 Buckets open to the world thanks to 'Authenticated Users' ACL

Some of Shopify's Amazon S3 buckets were inadvertently left with "Any Authenticated AWS User" read or write permissions, allowing users outside of Shopify to access the buckets. The excess permissions have been removed...

Shopify: Some S3 Buckets are world readable (and one is world writeable)

The researcher reported that several s3 bucket containing the name "shopify" were world-readable. Out of the reported buckets, two belonged to us and were not intended to be public and may have contained sensitive data. We changed the bucket options to disable file listing on the affected buckets...

Security auditing tool for AWS: AWS Scout2

Scout2 is an open source tool that helps assessing the security posture of AWS environments. Using the AWS API, the Scout2 Python scripts fetch CloudTrail, EC2, IAM, RDS, and S3, configuration data. The gathered configuration is analysed and stored as JSON objects in several JavaScript files. The...

buckets <= 0.1.9.2 - XSS in ZeroClipboard

The Buckets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

Apache APR-util 'buckets/apr_brigade.c' Denial Of Service Vulnerability

The host is installed with Apache APR-Util and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbapacheaprutildosvuln.nasl 5263 2017-02-10 13:45:51Z teissa $ Apache APR-util 'buckets/aprbrigade.c' Denial Of Service Vulnerability Authors: Antu Sanadi Copyright: Copyrig...