CVE-2015-9463

The CVE-2015-9463 entry concerns the WordPress plugin s3bubble-amazon-s3-audio-streaming (version 2.0). A directory traversal flaw exists in the plugin via the adverts/assets/plugins/ultimate/content/downloader.php path parameter, enabling access to restricted filesystem locations. Multiple conne...

CVE-2015-9464

CVE-2015-9464 – WordPress plugin vulnerability : The s3bubble-amazon-s3-html-5-video-with-adverts plugin for WordPress (version 0.7) contains a directory traversal flaw exposed through the adverts/assets/plugins/ultimate/content/downloader.php path parameter, allowing access to locations outside ...

Virus Bulletin 2019: Magecart Infestations Saturate the Web

LONDON — Magecart, the digital card-skimming collective, is now so ubiquitous that its infrastructure is flooding the internet. In a paper presented at Virus Bulletin 2019 this week in London, Jordan Herman and Yonathan Klijnsma of RiskIQ said that there are now 573 known C2 domains for the group...

Democrats and Doctors Behind Latest Wave of Leaked Data

Data leakage via misconfigured Amazon storage buckets struck twice in the past few weeks. In July, almost 14,000 documents detailing patient social security numbers and medical data – such as mental illness or cancer – was exposed in a misconfigured storage bucket owned by healthcare vendor Medic...

Magecart Hackers Infect 17,000 Sites Through Misconfigured Amazon S3 Buckets

Magecart strikes again! Cybersecurity researchers have identified yet another supply-chain attack carried out by payment card hackers against more than 17,000 web domains, which also include websites in the top 2,000 of Alexa rankings. Since Magecart is neither a single group nor a specific malwa...

TomTom: Listing of Amazon S3 Bucket accessible to any amazon authenticated user (vector-maps-e457472599)

Summary: It's possible to get a listing of every files in the S3 bucket vector-maps-e457472599 Description: The problem is using the AWS command line, it's possible to get a listing of files in the Amazon S3 Bucket with an AWS authentication. See screenshot vector-maps-e457472599publics3bucket.pn...

Leaky Amazon S3 Buckets Expose Data of Netflix, TD Bank

Three publicly-accessible cloud storage buckets from data management company Attunity leaked more than a terabyte of data from its top Fortune 100 customers – including internal business documents, system passwords, sensitive employee information. Israel-based Attunity, which was acquired by Qlik...

Magecart skimmers found on Amazon CloudFront CDN

Update 06-08-2019: The compromises of Amazon S3 buckets continue and some large sites are being affected. Our crawler spotted a malicious injection that loads a skimmer for the Washington Wizards page on the official NBA.com website. The skimmer was inserted in this JavaScript library:...

2.3B Files Exposed in a Year: A New Record for Misconfigs

The last 12 months has seen the exposure of a record 2.3 billion files across cloud databases and online shares, according to an analysis released on Thursday. A report from Digital Shadows’ Photon Research Team, Too Much Information: The Sequel, assessed the scale of inadvertent global data...

Facebook Data of Millions Exposed in Leaky Datasets

UPDATE Hundreds of millions of Facebook records – including account names, personal data, and more – have been found in two separate publicly-exposed app datasets. The first publicly-exposed dataset originates from a Mexico-based media company, Cultura Colectiva, and contains over 540 million...

Information Disclosure

openstack-glance is vulnerable to information disclosure. A flaw in the way certain image requests are handled allowed an authenticated user to obtain Glance's OpenStack Swift or Amazon S3 credentials...

Guardzilla Home Cameras Open to Anyone Wanting to Watch Their Footage

Another day, another internet of things IoT issue: A design flaw in the Guardzilla home video surveillance system has been discovered that allows users to watch other homeowners’ Guardzilla videos. The Guardzilla All-In-One Video Security System is a home security platform that provides indoor...

What happens when packages go bad?

I built spritecow.com back in 2011, and I no longer actively maintain it. A few months ago, a user berated me for using a crypto currency miner on the site without their informed consent. And sure enough, the site's JS had a small addition that loaded the mining JS, and sent the result somewhere...

GoDaddy Leaks ‘Map of the Internet’ via Amazon S3 Cloud Bucket Misconfig

UPDATE GoDaddy, the world’s largest domain name registrar, has exposed high-level configuration information for tens of thousands of systems and competitively sensitive pricing options for running those systems in Amazon AWS, thanks to yet another cloud storage misconfiguration. The documents wer...

Sensitive data on 31,000 GoDaddy servers exposed online

By Waqas All thanks to Unsecure AWS S3 Bucket. GoDaddy is the latest victim of cybercriminals and has joined the league of companies that got confidential data leaked due to unsecure Amazon S3 buckets. The world’s leading domain name registering platform, GoDaddy, boasts of more than 18m customer...

Thousands of U.S. Voter Personal Records Leaked by Robocall Firm

Researchers have discovered yet another misconfigured repository bucket – this time leaking the information of U.S. voters. The information was exposed on a public Amazon S3 bucket by a Virginia-based political campaign and robocalling company called Robocent. Kromtech Security researchers, who...

Honda, Universal Music Group Expose Sensitive Data in Misconfig Blunders

Server and cloud misconfigs continue to plague companies and their customers: This week it came to light that a Universal Music Group contractor neglected to protect an Apache Airflow server, leaving data exposed; while a Honda affiliate in India left two Amazon S3 buckets misconfigured for more...

gs-common.s3.amazonaws.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-620490 Description| Value ---|--- Affected Website:| gs-common.s3.amazonaws.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Chris Vickery Discusses Data Leak of 48 Million Users by Private Intelligence Firm

SAN FRANCISCO – Profile data of 48 million users that was scraped from social networks and websites ranging from Facebook, LinkedIn, Zillow and Twitter was leaked by a private intelligence agency. The data was left on an Amazon S3 storage bucket accessible without a password by Localblox, the...

S3Scanner - Scan For Open S3 Buckets And Dump

A quick and dirty script to find unsecured S3 buckets and dump their contents. Using The tool has 2 parts: 1 - s3finder.py This script takes a list of domain names and checks if they're hosted on Amazon S3. Found S3 domains are output to file with their corresponding region in format...