Amazon AWS SDK for PHP 安全漏洞

Amazon AWS SDK for PHP is a software development kit for Amazon Web Services based on the PHP platform from Amazon.com, USA. A security vulnerability exists in Amazon AWS SDK for PHP that stems from a lack of cryptographic key commitment, which could cause a user with write access to the S3 stora...

Amazon S3 Encryption Client 安全漏洞

Amazon S3 Encryption Client is a client-side encryption library open-sourced by Amazon Web Services. A security vulnerability exists in Amazon S3 Encryption Client that stems from a lack of encryption key promises, which could cause a user with write access to an S3 storage bucket to introduce a...

PT-2025-51883

Name of the Vulnerable Software and Affected Versions AWS SDK for Ruby versions prior to 1.208.0 Description A missing cryptographic key commitment in the AWS SDK for Ruby could allow a user with write access to an S3 bucket to introduce a new encryption data key EDK that decrypts to different...

PT-2025-51880

Name of the Vulnerable Software and Affected Versions Amazon S3 Encryption Client for .NET versions prior to 3.2.0 Description A flaw exists in the Amazon S3 Encryption Client for .NET where a missing cryptographic key commitment could allow a user with write access to an S3 bucket to introduce a...

Amazon S3 Encryption Client 安全漏洞

Amazon S3 Encryption Client is a client-side encryption library open-sourced by Amazon Web Services. A security vulnerability exists in Amazon S3 Encryption Client that stems from a lack of encryption key promises, which could cause a user with write access to an S3 storage bucket to introduce a...

AWS SDK for Ruby 安全漏洞

AWS SDK for Ruby is an open source developer toolkit for Ruby from Amazon Web Services. A security vulnerability exists in AWS SDK for Ruby that stems from a lack of cryptographic key promises, which could cause a user with write access to an S3 storage bucket to introduce a new EDK that decrypts...

Amazon S3 Encryption Client for .NET 安全漏洞

Amazon S3 Encryption Client for .NET is a client-side encryption library open-sourced by Amazon Web Services. A security vulnerability exists in Amazon S3 Encryption Client for .NET that stems from a lack of encryption key promises, which could cause a user with write access to an S3 storage buck...

AWS SDK for C++ 安全漏洞

AWS SDK for C++ is an open source developer toolkit for C++ by Amazon Web Services A security vulnerability exists in AWS SDK for C++ that stems from a lack of cryptographic key commitment, which could lead to a user with write access to an S3 storage bucket introducing a new EDK that decrypts a...

Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign

An ongoing campaign has been observed targeting Amazon Web Services AWS customers using compromised Identity and Access Management IAM credentials to enable cryptocurrency mining. The activity, first detected by Amazon's GuardDuty managed threat detection service and its automated security...

Cloud Security Leveraging AI: A Fusion-Based AISOC for Malware and Log Behaviour Detection

Cloud Security Operations Center SOC enable cloud governance, risk and compliance by providing insights visibility and control. Cloud SOC triages high-volume, heterogeneous telemetry from elastic, short-lived resources while staying within tight budgets. In this research, we implement an...

EUVD-2025-203445

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow authenticated users to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any account principal with...

Improper Cleanup Of Sensitive Data

Ansible is vulnerable to improper cleanup of sensitive data. The vulnerability is due to the awsssm connection plugin not performing garbage collection after playbook execution, which allows sensitive files to remain in the storage bucket and exposes confidential data to unauthorized access...

Privilege Escalation

awsadvancedpythonwrapper is vulnerable to Privilege Escalation. The vulnerability is due to improper execution context handling of user-defined functions, which allows an attacker to create crafted functions that execute with elevated privileges and gain unauthorized access...

Information Disclosure

Jenkins Git Client Plugin is vulnerable to an Information Disclosure. The vulnerability is due to differential form validation behavior, where Git URL validation responses vary based on whether an attacker-specified file path exists on the Jenkins controller when using the amazon-s3 protocol,...

Sensitive Information Disclosure

Jenkins Statistics Gatherer Plugin is vulnerable to Sensitive Information Disclosure. The vulnerability is due to storing the AWS Secret Key in plaintext in the global configuration file, allowing users with access to the Jenkins controller file system to read and misuse the credential...

Sensitive Information Disclosure

Jenkins Statistics Gatherer Plugin is vulnerable to Sensitive Information Disclosure. The vulnerability is due to failure to mask the AWS Secret Key in the global configuration UI, allowing attackers with configuration access to view and potentially capture the secret value...

Visualisation for the CIS Benchmark Scanning Results

In this paper, we introduce GraphSecure, a web application that provides advanced analysis and visualisation of security scanning results. GraphSecure enables users to initiate scans for their AWS account, validate them against specific Center for Internet Security CIS Benchmarks and return...

Malicious code in elf-stats-snowdusted-saddlebag-127 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7325ceba4496b91ea9304f6a233b4f3ebd14fbc089cfc782ee6d38b4f0b73c72 The package elf-stats-snowdusted-saddlebag-127 was found to contain malicious code...

Malicious code in elf-stats-silvered-cushion-811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b286c15af60d0b9ac223301be4cc653e4bdb51af0dabe6fbf5b4c22b8418a3b The package elf-stats-silvered-cushion-811 was found to contain malicious code...

Malicious code in elf-stats-sparkly-fir-398 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32db911f51c2d89fb28fbfb18ca7522203bb6e5606c84bb23665427fd481feee The package elf-stats-sparkly-fir-398 was found to contain malicious code...