Razer: Subdomain takeover at iosota.razersynapse.com via Amazon S3

The tester discovered a dangling DNS record for iosota.razersynapse.com that was no longer in use and demonstrated a subdomain takeover. Subdomain takeovers by themselves are not in the scope of our program, but Razer thanks the tester for their diligence and clear report...

SUSE SLES12 Security Update : python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer (SUSE-SU-2020:0555-1)

This update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, python-jsonpatch, python-jsonpointer, python-scandir, python-PyYAML fixes the...

U.S. Dept Of Defense: No ACL on S3 Bucket in [https://www.██████████/]

Summary: Hi team!, i was able to move and download all file in s3 bucket that's under ████ control cuz it didn't has ACL Step-by-step Reproduction Instructions first we will try to access all files via browser by go to this s3.amazonaws.com/files.████████ Now We Will try to download all files on...

Product release: Virtuozzo Infrastructure Platform 3.5 Update 1 (3.5.1-43)

This update provides a new feature as well as fixes and improvements. Vulnerability id: VSTOR-30003 Unable to release node from cluster: 'Unable to send message to any node in ABGW cluster'. Vulnerability id: VSTOR-30135 No read/write data on dashboards if multipath is configured. Vulnerability i...

Gospider - Fast Web Spider Written In Go

GoSpider - Fast web spider written in Go Installation go get -u github.com/jaeles-project/gospider Features Fast web crawling Brute force and parse sitemap.xml Parse robots.txt Generate and verify link from JavaScript files Link Finder Find AWS-S3 from response source Find subdomains from respons...

Amazon AWS JavaScript S3 Explorer Cross-Site Scripting Vulnerability

Amazon AWS JavaScript S3 Explorer is a set of S3 browsers. A cross-site scripting vulnerability exists in Amazon AWS JavaScript S3 Explorer explorer.js, which can be exploited by remote attackers to inject malicious script or HTML code, which can be used to gain access to sensitive information or...

This Week in Security News: February 2020 Patch Tuesday Update and Misconfigured AWS S3 Bucket Leaks 36,000 Inmate Records

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the more than 140 February Patch Tuesday updates from Microsoft and Adobe. Also, read about how an unsecured and unencrypted...

CVE-2019-14652

explorer.js in Amazon AWS JavaScript S3 Explorer aka aws-js-s3-explorer v2 alpha before 2019-08-02 allows XSS in certain circumstances...

CVE-2019-14652

explorer.js in Amazon AWS JavaScript S3 Explorer aka aws-js-s3-explorer v2 alpha before 2019-08-02 allows XSS in certain circumstances...

Cross site scripting

explorer.js in Amazon AWS JavaScript S3 Explorer aka aws-js-s3-explorer v2 alpha before 2019-08-02 allows XSS in certain circumstances...

CVE-2019-14652

CVE-2019-14652 affects the Amazon AWS JavaScript S3 Explorer (aws-js-s3-explorer) in the v2 alpha line prior to 2019-08-02. The connected documents specify a Cross-Site Scripting (XSS) vulnerability in explorer.js, enabling injection of malicious script or HTML under certain circumstances when pr...

CVE-2019-14652

explorer.js in Amazon AWS JavaScript S3 Explorer aka aws-js-s3-explorer v2 alpha before 2019-08-02 allows XSS in certain circumstances...

CVE-2020-2114

Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Design/Logic Flaw

Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2114

Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2114

CVE-2020-2114 affects the Jenkins S3 Publisher Plugin (versions ≤ 0.11.4). The plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, exposing secrets to the browser environment and potentially to extensions or scripts. The root cause is the creden...

PT-2020-15321 · Jenkins · Jenkins S3 Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins S3 publisher Plugin versions 0.11.4 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure. This...

Unable to Create Folder (name: ) Error

Challenge The following error occurs when creating a folder in the S3-Compatible Object Storage bucket: "Unable to create folder name: ". Cause Certain S3-compatible API do not support an unsigned payload used by Veeam Backup for Microsoft 365 as the x-amz-content-sha256 authorization header...

Takeover v0.2 - Sub-Domain TakeOver Vulnerability Scanner

Sub-domain takeover vulnerability occur when a sub-domain subdomain.example.com is pointing to a service e.g: GitHub , AWS/S3 ,.. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that sub-domain. For example, if...

Invalid Character in Amazon S3 Bucket Name

Challenge When adding/editing an object storage repository and selecting or creating a folder in the Amazon S3 bucket, the following error occurs: Could not establish trust relationship for the SSL/TLS secure channel. Applicable to build 4.0.0.1553. Exception of type...