CVE-2020-1760: Improper Neutralization of Input During Web Page Generation

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input...

CVE-2020-1760

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input...

How to Create Secure IAM Policy for Connection to S3 Object Storage

KB ID: | 3151 ---|--- Product: | Veeam Backup & Replication Published: | 2020-04-21 Last Modified: | 2026-08-10 Get weekly article updates SUBSCRIBE By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice. Cheers for trusti...

Shift Well-Architecture Left. By Extension, Security Will Follow

A story on how Infrastructure as Code can be your ally on Well-Architecting and securing your Cloud environment By Raphael Bottino, Solutions Architect -- first posted as a medium article Using Infrastructure as CodeIaC for short is the norm in the Cloud. CloudFormation, CDK, Terraform, Serverles...

Topcoder: SVG file upload leads to XML injection

Summary: Upload Avatar option allows the user to upload image/ . Thus enabling the upload of many file formats including SVG files MIME type: image/svg+xml SVG files are XML based graphics files in 2D images. Thus, this opens up an attack vector to upload specially crafted malicious SVG files. Th...

Code injection

An issue was discovered on Samsung mobile devices with S3KK, Note2KK, S4L, Note3L, and S5L software. An attacker can rewrite the IMEI by flashing crafted firmware. The Samsung ID is SVE-2016-5562 March 2016...

CVE-2020-1760

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. Mitigation Mitigation provided by DigitalOcean: Mitigation relies on the HAProx...

CVE-2016-11050: Undefined Security Weakness

An issue was discovered on Samsung mobile devices with S3KK, Note2KK, S4L, Note3L, and S5L software. An attacker can rewrite the IMEI by flashing crafted firmware. The Samsung ID is SVE-2016-5562 March 2016...

Sandcastle - A Python Script For AWS S3 Bucket Enumeration

Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...

44M Digital Wallet Items Exposed in Key Ring Cloud Misconfig

Key Ring, creator of a digital wallet app used by 14 million people across North America, has exposed 44 million IDs, charge cards, loyalty cards, gift cards and membership cards to the open internet, researchers say. The Key Ring app allows users to upload scans and photos of various physical...

@copart/ops-tool-kit (>=0.0.37, <=0.0.53), @openfin/multer-s3 (>=2.0.0, <=2.2.0) +4 more potentially affected by CVE-2019-20149 via kind-of (6.0.2)

kind-of NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on kind-of and may be impacted: - @copart/ops-tool-kit =0.0.37, =2.0.0, =0.0.1, =0.0.3, =0.1.0, =1.2.6 Source cves: CVE-2019-20149 Source advisory: OSV:GHSA-6C8F-QPHG-QJGP...

AWSGen.py - Generates Permutations, Alterations And Mutations Of AWS S3 Buckets Names

AWSGen.py is a simple tool for generates permutations, alterations and mutations of AWS S3 Buckets Names. Download AWSGen.py...

Greenhouse.io: Open S3 Bucket Accessible by any Aws User

hi team, vulnerable URL: http://grnhse-marketing-site-assets.s3.amazonaws.com/ There is no authentication required to access the AWS bucket of the website. As your site was associated with AWS, any AWS user can view the content , navigate through directories and download files, public access is...

Razer: Subdomain takeover at iosota.razersynapse.com via Amazon S3

The tester discovered a dangling DNS record for iosota.razersynapse.com that was no longer in use and demonstrated a subdomain takeover. Subdomain takeovers by themselves are not in the scope of our program, but Razer thanks the tester for their diligence and clear report...

SUSE SLES12 Security Update : python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer (SUSE-SU-2020:0555-1)

This update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, python-jsonpatch, python-jsonpointer, python-scandir, python-PyYAML fixes the...

U.S. Dept Of Defense: No ACL on S3 Bucket in [https://www.██████████/]

Summary: Hi team!, i was able to move and download all file in s3 bucket that's under ████ control cuz it didn't has ACL Step-by-step Reproduction Instructions first we will try to access all files via browser by go to this s3.amazonaws.com/files.████████ Now We Will try to download all files on...

Product release: Virtuozzo Infrastructure Platform 3.5 Update 1 (3.5.1-43)

This update provides a new feature as well as fixes and improvements. Vulnerability id: VSTOR-30003 Unable to release node from cluster: 'Unable to send message to any node in ABGW cluster'. Vulnerability id: VSTOR-30135 No read/write data on dashboards if multipath is configured. Vulnerability i...

Amazon AWS JavaScript S3 Explorer Cross-Site Scripting Vulnerability

Amazon AWS JavaScript S3 Explorer is a set of S3 browsers. A cross-site scripting vulnerability exists in Amazon AWS JavaScript S3 Explorer explorer.js, which can be exploited by remote attackers to inject malicious script or HTML code, which can be used to gain access to sensitive information or...

This Week in Security News: February 2020 Patch Tuesday Update and Misconfigured AWS S3 Bucket Leaks 36,000 Inmate Records

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the more than 140 February Patch Tuesday updates from Microsoft and Adobe. Also, read about how an unsecured and unencrypted...

CVE-2019-6190: Improper Initialization

Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep S3 on systems with Intel TXT enabled...