Rapid7 Announces Release of New tCell Amazon CloudFront Agent

Cloud-native approaches to building, hosting, and delivering web applications are growing rapidly. Content delivery networks CDNs such as Amazon CloudFront are on the rise, pushing content closer to end users to improve the performance of web applications. To protect web applications security tea...

InsightIDR’s NTA Capabilities Expanded to AWS

We’re excited to announce we have expanded the Network Traffic Analysis NTA capabilities in InsightIDR to support Amazon Web Services AWS environments. This means InsightIDR and MDR customers can now ingest detailed network data from AWS, including north/south and east/west traffic across a...

How to Deploy FLR Relay Proxy

Deprecated Feature The FLR Relay Proxy feature described in this article was deprecated in Veeam Backup for AWS 7. In deployments where the feature was enabled before upgrading to Veeam Backup for AWS 7, the FLR Relay tab will still appear in the options. However, for Veeam Backup for AWS 7...

Shift Well-Architecture Left. By Extension, Security Will Follow

A story on how Infrastructure as Code can be your ally on Well-Architecting and securing your Cloud environment By Raphael Bottino, Solutions Architect -- first posted as a medium article Using Infrastructure as CodeIaC for short is the norm in the Cloud. CloudFormation, CDK, Terraform, Serverles...

Automating API Security in the Cloud

These days, the most common way for services to communicate and transfer data is by using APIs. However, broken, exposed, or hacked APIs are the cause of some of the latest major data breaches, as they have the potential to expose sensitive data for public consumption. Securing your APIs is...

BeeGFS 7.1.3 Privilege Escalation Vulnerability

============================================ BeeGFS Privilege Escalation CVE-2019-15897 ============================================ Software: BeeGFS Affected Versions: All versions upto and including 7.1.3 Vendor: ThinkparQ CVE: CVE-2019-15897 Severity: CVSS 9.6 Critical...

CloudBees Jenkins jenkins-cloudformation-plugin Plugin Trust Management Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . jenkins-cloudformation-plugin Plugin is used in o...

CVE-2019-1003061

Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003061

Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003061

Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003061

CVE-2019-1003061 affects the Jenkins ecosystem via the jenkins-cloudformation-plugin, which stores credentials unencrypted in job config.xml files on the Jenkins master/controller. The root cause described across multiple connected records is that credentials are kept in plain text, enabling view...

PT-2019-11351 · Jenkins · Jenkins-Cloudformation-Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins jenkins-cloudformation-plugin Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. These credentials ca...

AWS Pwn - A Collection Of AWS Penetration Testing Junk

This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please feel free to...

aws-cfn-bootstrap Local Code Execution

aws-cfn-bootstrap local code execution as root ============================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/aws-cfn-bootstrap-local-code-execution-as-root.txt Overview -------- AWS EC2 instances deployed with the AWS...

Amazon Web Services CloudFormation bootstrap arbitrary code execution vulnerability

The Amazon Web Services AWS CloudFormation bootstrap tools package also known as aws-cfn-bootstrap is a suite of cloud computing services from Amazon.com, Inc.The CloudFormation bootstrap tools package is one of the cloud resource configuration toolkits. A security vulnerability exists in the...

CVE-2017-9450

The Amazon Web Services AWS CloudFormation bootstrap tools package aka aws-cfn-bootstrap before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory...

Directory traversal

The Amazon Web Services AWS CloudFormation bootstrap tools package aka aws-cfn-bootstrap before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory...

CVE-2017-9450

The Amazon Web Services AWS CloudFormation bootstrap tools package aka aws-cfn-bootstrap before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory...

CVE-2017-9450

The Amazon Web Services AWS CloudFormation bootstrap tools package aka aws-cfn-bootstrap before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory...