HackerOne: Obtain the username & the uid of the one doing the S3 sync on Hackerone

Obtain the username & uid of hackerone.com S3 using GET, it's possible to obtain the username & uid of the one doing the S3 sync on Hackerone. Doing a GET on : http://hackerone.com Give the following header : content-security-policy = default-src 'none'; base-uri 'self'; block-all-mixed-content;...

Udemy: Udemy s3 storage can be used by an attacker personal website because of missing CSRF Token

The report was about a staging S3 bucket where we allow any file to be uploaded and then further process it from there. It was closed as informative because there is no security risk associated with it...

Reverb.com: Possible Blind Writing to S3 Bucket

Hi All, I noticed that you are using S3 and I believe I may have found one of your buckets and am able to write to it. However, I can not list the files in the bucket and such can not be 100% sure you own it. If you don't, I'd really appreciate being able to close this report myself or have you...

PT-2016-3386

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.1u OpenSSL versions prior to 1.0.2i Description The issue is related to a buffer over-read in the certificate parser of OpenSSL, which could allow remote attackers to cause a denial of service. This is achieved...

DigitalSellz: Access to Amazon S3 bucket

@sameoldstory discovered a vulnerability that allows a user can gain access to S3. This Vulnerability has been fixed...

DigitalSellz: AWS Signature Disclosure in www.digitalsellz.com allows access to S3

@skorov discovered a vulnerability that allows a user can gain access to S3. This Vulnerability has been fixed. An information disclosure vulnerability was found that allowed an attacker to have arbitrary AWS requests signed with the secret key. The signature could then be used to view, edit,...

Bugs in Signal Messaging App Corrupt Attachments, Crash App

Makers of the mobile encrypted chat app Signal say they have fixed vulnerabilities in the Android version of the messaging app that allowed attackers to corrupt encrypted attachments and remotely crash the application. The vulnerabilities were discovered by Jean-Philippe Aumasson and Markus Vervi...

Legal Robot: 2 vulns

the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...

Legal Robot: Information Disclosure in AWS S3 Bucket

Hi, While this doesn't fall directly under the Program scope, I feel that the subject of this report is directly connected to the primary Legal Robot web properties and would like to inform your team in case this was a misconfiguration concern. I noticed that legalrobot.amazonaws.com is configure...

HackerOne: Users contents on AWS is cacheable

Hi , Background ============================= As I know you are using AWS S3 for saving and serving files . The AWS S3 on https://hackerone-attachments.s3.amazonaws.com are been called every time to show images on hackerone.com . For example view this report 145392 You will see a request for Fran...

Bime: Subdomain takeover at ws.bimedb.com due to unclaimed Amazon S3 bucket

The researcher found a subdomain takeover on ws.bimedb.com...

Automated Malware Incident Response & Analysis: AMIRA

Automated Malware Incident Response & Analysis AMIRA is a service for automatically running the analysis on the OSXCollector output files. The automated analysis is performed via OSXCollector Output Filters, in particular The One Filter to Rule Them All : the Analyze Filter. AMIRA takes care of...

Harvest: S3 bucket takeover due to proxy.harvestfiles.com

Summary --------- I can takeover your ███ S3 bucket. You are using https://proxy.harvestfiles.com to proxy requests to this bucket. The proxy automatically signs the requests and adds the required authorization headers for your S3 user. However, an attacker can then simply impersonate the user an...

Legal Robot: AWS S3 website can't serve security headers, may allow clickjacking

Security researcher discovered that our AWS S3 website was not serving some basic security headers like X-Frame-Options. We resolved the issue by putting nginx in front of our AWS S3 website and adding header directives. Fixed security headers can be verified here: https://schd.io/zt...

transfer.sh - Easy and Fast File Sharing from the Command-line

Easy and fast file sharing from the command-line. This code contains the server with everything you need to create your own instance. Transfer.sh support currently the s3 Amazon S3 provider and local file system local. Usage Upload: $ curl --upload-file ./hello.txt https://transfer.sh/hello.txt...

Debian DSA-3583-1 : swift-plugin-s3 - security update

It was discovered that the swift3 S3 compatibility middleware plugin for Swift performed insufficient validation of date headers which might result in replay attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

[SECURITY] [DSA 3583-1] swift-plugin-s3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3583-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 18, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3583-1 (swift-plugin-s3 - security update)

It was discovered that the swift3 S3 compatibility middleware plugin for Swift performed insufficient validation of date headers which might result in replay attacks. OpenVAS Vulnerability Test $Id: deb3583.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3583-1 using...

DSA-3583-1 swift-plugin-s3 - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3583-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...