s3enum

s3enum s3enum is a fast and stealthy Amazon S3 bucket enumeration tool. It leverages DNS instead of HTTP, which means that requests are not logged in S3 server access logs. It was originally built back in 2016 to target GitHub. Installation go install github.com/koenrh/s3enum@latest Usage You nee...

bucket-stream

🚨 Bucket Stream n'est plus maintenu. Si vous avez besoin de soutien ou de consultation pour vos efforts de red teaming, envoyez-moi un e-mail à [email protected] 🚨 Bucket Stream Trouvez des buckets Amazon S3 intéressants en surveillant les logs de transparence des certificats. Cet outil écou...

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

s3tk

s3tk A security toolkit for Amazon S3 🍊 Battle-tested at Instacart Installation Run: pip install s3tk You can use the AWS CLI or AWS Vault to set up your AWS credentials: pip install awscli aws configure See IAM policies needed for each command. Commands Scan Scan your buckets for: ACL open to...

s3tk

s3tk Une boîte à outils de sécurité pour Amazon S3 🍊 Éprouvée sur le terrain chez Instacart Installation Exécutez : pip install s3tk Vous pouvez utiliser AWS CLI ou AWS Vault pour configurer vos identifiants AWS : pip install awscli aws configure Consultez les politiques IAM nécessaires pour chaq...

s3enum

s3enum s3enum est un outil d'énumération de buckets Amazon S3 rapide et discret. Il utilise le DNS au lieu de HTTP, ce qui signifie que les requêtes ne sont pas enregistrées dans les journaux d'accès du serveur S3. Il a été initialement créé en 2016 pour cibler GitHub. Installation go install...

s3crets_scanner

S3cret Scanner : Chasse aux secrets téléversés dans les buckets S3 publics L'outil S3cret Scanner conçu pour fournir une couche complémentaire aux Bonnes pratiques de sécurité Amazon S3 en chassant proactivement les secrets dans les buckets S3 publics. Peut être exécuté comme tâche planifiée ou à...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

EUVD-2026-91175

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to and including 3.3.34 . The root cause is that the plugin trusts an attacker-supplied file path from form submissions during the External File Upload (Amazon S3) flow. This unvalida...

PT-2026-104083

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file path,...

BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

CVE-2026-44162: Improper Handling of Highly Compressed Data (Data Amplification)

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

CVE-2026-86175: Insufficiently Protected Credentials

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

[SECURITY] Fedora 43 Update: restic-0.19.1-1.fc43

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

CVE-2026-61448: Unrestricted Upload of File with Dangerous Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...