CVE-2021-43858

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

CVE-2021-43858

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

Design/Logic Flaw

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

CVE-2021-43858

CVE-2021-43858 affects MinIO, a Kubernetes-native cloud storage server. A flaw in the admin API (AddUser) allowed a malicious client to hand-craft an HTTP request to update a user’s policy and gain elevated privileges prior to patch release. The fix in patch release RELEASE.2021-12-27T07-23-18Z c...

CVE-2021-43858 User privilege escalation in MinIO

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

CVE-2021-43858

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

Design/Logic Flaw

Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether th...

The importance of backing up

What does backing up something mean? Backing up is the act of making a copy or copies of a file. These files are stored somewhere other than where the originals are located. You may only need to back up a few files, or it might be a much bigger effort. Requirements may differ greatly depending on...

Sophos Secure Workspace For Android Competition Condition Issue Vulnerability

Sophos Secure Workspace For Android is an application from Sophos UK for Android. Used to manage documents stored in the cloud and view documents published via Sophos Mobile servers, Sophos Secure Workspace For Android is vulnerable to a contention issue that could be exploited by a local attacke...

CVE-2021-41137

Minio is a Kubernetes native application for cloud storage. All users on release RELEASE.2021-10-10T16-53-30Z are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid should return owner true for rootCreds. In the affected version, poli...

CVE-2021-41137

Minio is a Kubernetes native application for cloud storage. All users on release RELEASE.2021-10-10T16-53-30Z are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid should return owner true for rootCreds. In the affected version, poli...

CVE-2021-41137

CVE-2021-41137 affects MinIO, a Kubernetes-native cloud storage server. The vulnerability stems from policy restrictions failing to properly apply access control for regular users who lack svc or STS accounts, allowing bypass of checks by the checkKeyValid() function for rootCreds. Affected relea...

Iranian Hackers Abuse Dropbox in Cyberattacks Against Aerospace and Telecom Firms

Details have emerged about a new cyber espionage campaign directed against the aerospace and telecommunications industries, primarily in the Middle East, with the goal of stealing sensitive information about critical assets, organizations' infrastructure, and technology while remaining in the dar...

Here's a New Free Tool to Discover Unprotected Cloud Storage Instances

The IDC cloud security survey 2021 states that as many as 98% of companies were victims of a cloud data breach within the past 18 months. Fostered by the pandemic, small and large organizations from all over the world are migrating their data and infrastructure into a public cloud, while often...

A6: Security Misconfiguration ❗️ — Top 10 OWASP 2017

A6: Security Misconfiguration ❗️ — Top 10 OWASP 2017 Introduction A6: Security Misconfiguration What is Security Misconfiguration? I believe this name was chosen to be as ambiguous as possible for one of the Top 10 OWASP vulnerabilities. It can encompass anything and everything related to...

Exposure of Sensitive Information to an Unauthorized Actor

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The...

GHSA-6GR8-C3M5-MVRG Exposure of Sensitive Information to an Unauthorized Actor

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The...

CVE-2021-38621

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership...

netless Agora Flat Server 安全漏洞

The netless Agora Flat Server is a Node.js server for the Agora Flat open source classroom. A security vulnerability exists in netless Agora Flat Server, which stems from the remove API handling file ownership error in v1/controller/cloudStorage/alibabaCloud/remove/index.ts...

CNA legal filings lift the curtain on a Phoenix CryptoLocker ransomware attack

Two months after fully restoring its systems, CNA Financial, the leading US insurance company that was attacked by a group using Phoenix CryptoLocker ransomware, issued a legal notice of an information security incident to the Consumer Protection Bureau in New Hampshire. You may recall that Phoen...