757 matches found
CVE-2024-36107 Information disclosure in minio
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. If-Modified-Since and If-Unmodified-Since headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a...
CVE-2024-36107 Information disclosure in minio
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. If-Modified-Since and If-Unmodified-Since headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a...
CVE-2024-36107 Information disclosure in minio
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. If-Modified-Since and If-Unmodified-Since headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a...
PT-2024-5523 · Minio +2 · Minio +2
Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2024-05-27T19-17-46Z Description: The issue concerns the use of If-Modified-Since and If-Unmodified-Since headers with anonymous requests, allowing an attacker to determine if an object exists on the server in ...
minio -- unintentional information disclosure
Minio security advisory GHSA-95fr-cm4m-q5p9 reports: when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information...
MinIO 安全漏洞
MinIO is a high-performance object storage service released under the GNU Affero General Public License v3.0. A security vulnerability exists in version MinIO RELEASE.2022-10-02T19-29-29Z, which stems from the disclosure of information about the presence of If-Modified-Since, If-Unmodified-Since...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Minio
MinIO vulnerability exploit CVE-2023-28432 Description T...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Minio
MinIO vulnerability exploit CVE-2023-28432 Description T...
MinIO Privilege Escalation
Exploit Title: MinIO 2024-01-31T20-20-33Z - Privilege Escalation Date: 2024-04-11 Exploit Author: Jenson Zhao Vendor Homepage: https://min.io/ Software Link: https://github.com/minio/minio/ Version: Up to excluding RELEASE.2024-01-31T20-20-33Z Tested on: Windows 10 CVE : CVE-2024-24747 Required...
MinIO < 2024-01-31T20-20-33Z - Privilege Escalation Exploit
Exploit Title: MinIO 2024-01-31T20-20-33Z - Privilege Escalation Exploit Author: Jenson Zhao Vendor Homepage: https://min.io/ Software Link: https://github.com/minio/minio/ Version: Up to excluding RELEASE.2024-01-31T20-20-33Z Tested on: Windows 10 CVE : CVE-2024-24747 Required before execution:...
MinIO < 2024-01-31T20-20-33Z - Privilege Escalation
Exploit Title: MinIO 2024-01-31T20-20-33Z - Privilege Escalation Date: 2024-04-11 Exploit Author: Jenson Zhao Vendor Homepage: https://min.io/ Software Link: https://github.com/minio/minio/ Version: Up to excluding RELEASE.2024-01-31T20-20-33Z Tested on: Windows 10 CVE : CVE-2024-24747 Required...
ROS-20240410-19
The MinIO object storage server vulnerability is related to flaws in access differentiation based on the UpdateServiceAccountAdminAction policy. Exploitation of the vulnerability could allow an attacker, acting remotely to escalate their privileges...
GHSA-4V7X-PQXF-CX7M vulnerabilities
Vulnerabilities for packages: speedtest-go, litestream, ytt, aactl, cosign, kubebuilder, rabbitmq-cluster-operator, yam, capslock, terraform-docs, pulumi, terraform-provider-sendgrid, neuvector-scanner, gitness, crossplane-provider-aws-ec2, nri-rabbitmq, crossplane-provider-azure-managedidentity,...
Metasploit Wrap-Up 03/15/2024
New module content 3 GitLab Password Reset Account Takeover Authors: asterion04 and h00die Type: Auxiliary Pull request: 18716 contributed by h00die Path: admin/http/gitlabpasswordresetaccounttakeover AttackerKB reference: CVE-2023-7028 Description: This adds an exploit module that leverages an...
MinIO Bootstrap Verify Information Disclosure
MinIO is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. Verified...
CVE-2024-28122 vulnerabilities
Vulnerabilities for packages: boring-registry, minio, boring-registry-fips, falcoctl, falcoctl-fips, spire-server, minio-fips, mc-fips, external-secrets-fips, spire-server-fips, mc...
GHSA-HJ3V-M684-V259 vulnerabilities
Vulnerabilities for packages: boring-registry, minio, boring-registry-fips, falcoctl, falcoctl-fips, spire-server, minio-fips, mc-fips, external-secrets-fips, spire-server-fips, mc...
BIT-MINIO-2020-11012 Authentication bypass MinIO Admin API
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has bee...
BIT-MINIO-2021-21287 Server-Side Request Forgery in MinIO Browser API
MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or...
BIT-MINIO-2021-21362 Bypassing readOnly policy by creating a temporary 'mc share upload' URL
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...