Invalid Character in Amazon S3 Bucket Name

Challenge When adding/editing an object storage repository and selecting or creating a folder in the Amazon S3 bucket, the following error occurs: Could not establish trust relationship for the SSL/TLS secure channel. Applicable to build 4.0.0.1553. Exception of type...

Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service

When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...

Dufflebag - Search Exposed EBS Volumes For Secrets

Dufflebag is a tool that searches through public Elastic Block Storage EBS snapshots for secrets that may have been accidentally left in. You may be surprised by all the passwords and secrets just laying around! The tool is organized as an Elastic Beanstalk "EB", not to be confused with EBS...

chhyun-utils (>=1.0.12, <=1.0.39), jotunheimr (>=1.11.0, <=1.12.1) +4 more potentially affected by CVE-2019-10788 via im-metadata (>=2.1.1, <=3.0.1)

im-metadata NPM version =2.1.1, =1.0.12, =1.11.0, =1.0.0-rc.1, =0.0.1, =2.0.2, =2.0.3 - wn-s3-uploader 1.0.0 Source cves: CVE-2019-10788 Source advisory: SNYK:JS-IMMETADATA-544184...

chhyun-utils (>=1.0.12, <=1.0.39), jotunheimr (>=1.11.0, <=1.12.1) +4 more potentially affected by CVE-2019-10787 via im-resize (>=2.0.2, <=2.3.2)

im-resize NPM version =2.0.2, =1.0.12, =1.11.0, =1.0.0-rc.1, =0.0.1, =2.0.2, =2.0.3 - wn-s3-uploader 1.0.0 Source cves: CVE-2019-10787 Source advisory: SNYK:JS-IMRESIZE-544183...

Scale-out Backup Repository offload job to Quantum DXI used as S3 storage fails with "Failed to retrieve SSL certificate. Underlying error: PRNG not seeded" error

Challenge Veeam Backup & Replication fails to perform an S3 offload task if targeted to Quantum DXI storage. The error retrieved in UI says: "Failed to retrieve SSL certificate. Underlying error: PRNG not seeded" 06.01.2020 13:38:21 Info PublicCloudCertificateLoader Loading certificate for...

This Week in Security News: Over 2,000 WordPress Accounts Compromised and Facebook to Pay $550M to Settle Class Action Case Over Facial Recognition

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, over two thousand WordPress sites were compromised using a malicious script that redirects visitors to scam websites. Also, read about how...

Automating API Security in the Cloud

These days, the most common way for services to communicate and transfer data is by using APIs. However, broken, exposed, or hacked APIs are the cause of some of the latest major data breaches, as they have the potential to expose sensitive data for public consumption. Securing your APIs is...

Lyst: Subdomain takeover of storybook.lystit.com

Summary: The subdomain storybook.lystit.com had an CNAME record pointing to an unclaimed S3 bucket. This is a high severity security issue because an attacker can register the bucket on AWS and therefore can serve her own content on the subdomain. This allows for various attacks. Description: The...

Ruby: Source code disclosed via S3 Bucket

Summary The Ruby having an Amazon S3 bucked named http://rubyci.s3.amazonaws.com/ which lists some of their log files. Those logs having some informations to check the source code server side directories. Steps to Reproduce 1. direct to http://rubyci.s3.amazonaws.com/ which having READ Permission...

Product release: Virtuozzo Infrastructure Platform 3.5

In this release, Virtuozzo Infrastructure Platform offers a wide range of new features that enhance the experience of users working with compute virtualization and software-defined networking functionalities. Additionally, the update delivers stability improvements and addresses bugs found in...

prd-medweb-cdn.s3.amazonaws.com Improper Access Control vulnerability

Security Researcher NotAkay Helped patch 1 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting prd-medweb-cdn.s3.amazonaws.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard...

How we Developed a Unified Binary Store (UBS): Part 1

Like most technology companies, VMware Carbon Black has a combination of acquired and built technologies that all utilize their own data stores. As our products have evolved to include the benefits of a centralized cloud offering, our data stores needed to similarly evolve. A new goal was formed:...

Razer: Aws bucket writable mobile.razer.com

The tester discovered an S3 bucked owned by Mobile that was writeable. No files were present but the permissions were incorrect and subsequently fixed. Razer appreciates the report...

CVE-2013-4763

Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission...

CVE-2013-4764

Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations without permission...

Code injection

Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission...

CVE-2013-4764

CVE-2013-4764 describes a vulnerability in Samsung Galaxy S3/S4 where a built-in component (sCloudBackupProvider.apk) exposes unprotected components that an unprivileged app can abuse to send arbitrary SMS texts to arbitrary destinations without permission. The root cause involves triggering a se...

CVE-2013-4763

Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission...

CVE-2013-4763

CVE-2013-4763 affects Samsung Galaxy S3/S4 and involves a pre-loaded component (sCloudBackupProvider.apk) that exposes unprotected components. An unprivileged app can trigger a restore operation to write arbitrary SMS messages to the system SMS database (mmssms.db) via these components, enabling ...