CVE-2023-51651 Potential URI resolution path traversal in the AWS SDK for PHP

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK f...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

Amazon Sandbox Accounts for Events Access Control Error Vulnerability

Amazon Sandbox Accounts for Events is an application from Amazon.com, Inc. It allows multiple temporary AWS accounts to be provisioned to multiple authenticated users at the same time through a browser-based GUI. An access control error vulnerability exists in Amazon Sandbox Accounts for Events...

Buildkite Elastic CI Stack for AWS Security Vulnerability

Buildkite Elastic CI Stack for AWS is an application from Buildkite that provides private, auto-scaling clusters of Buildkite Agents. A security vulnerability exists in Buildkite Elastic CI Stack for AWS versions prior to 6.7.1, prior to 5.22.5, which stems from a symbolic link that allows...

AWS SDK for PHP Path Traversal Vulnerability

Amazon AWS SDK for PHP is a software development kit for Amazon Web Services from Amazon.com, Inc. based on the PHP platform. A path traversal vulnerability exists in AWS SDK for PHP versions prior to 3.288.1, which stems from the presence of a URI path traversal vulnerability...

Amazon Sandbox Accounts for Events Security Breach

Amazon Sandbox Accounts for Events is an application from Amazon.com, Inc. It allows multiple temporary AWS accounts to be made available to multiple authenticated users at the same time through a browser-based GUI. A security vulnerability exists in Amazon Sandbox Accounts for Events prior to...

PT-2023-31869

Name of the Vulnerable Software and Affected Versions AWS SDK for PHP versions prior to 3.288.1 Description A URI path traversal issue exists in the AWS SDK for PHP, specifically within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot. This issue is possible du...

CVE-2023-31215

Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2...

CVE-2023-31215

Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2...

CVE-2023-31215

CVE-2023-31215 arises from an Unrestricted Upload of File with Dangerous Type in the WordPress plugin Dropshipping & Affiliation with Amazon (WP Amazon Shop) for versions

CVE-2023-31215 WordPress Dropshipping & Affiliation with Amazon Plugin <= 2.1.2 is vulnerable to Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own...

Expanded Coverage and AWS Compliance Pack Updates in InsightCloudSec Coming Out of AWS Re:Invent 2023

It seems like it was just yesterday that we were in Las Vegas for AWS Re:Invent, but it’s already been almost two weeks since the conference wrapped up. As is always the case, AWS unveiled a host of new services throughout the week, including advancements around serverless, artificial intelligenc...

PT-2023-23236 · Amadercode · Dropshipping & Affiliation With Amazon

Name of the Vulnerable Software and Affected Versions: Dropshipping & Affiliation with Amazon versions n/a through 2.1.2 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon. This allows for...

WordPress Plugin Dropshipping & Affiliation with Amazon Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Dropshipping &...

CVE-2023-34382

The Dokan WordPress plugin (Dokan – Best WooCommerce Multivendor Marketplace Solution) is affected up to version 3.7.19. The issue is a PHP Object Injection due to insecure deserialization of untrusted data in the plugin’s codebase. This vulnerability can impact confidentiality, integrity, and av...

TotalCloud Insights: Hidden Risks of Amazon S3 Misconfigurations

Misconfiguring Amazon S3 Buckets Can Pose Major Risks Amazon Web Services AWS is the world’s largest cloud security provider, and it provides the ability to store massive amounts of cloud-resident data with the Amazon Simple Storage Service S3 bucket. Amazon S3 is an object storage solution known...

A week in security (December 11 &#8211; December 17)

Last week on Malwarebytes Labs: PikaBot distributed via malicious search ads Chrome starts the countdown to the end of tracking cookies Apple to introduce new feature that makes life harder for iPhone thieves Recently-patched Apache Struts vulnerability used in worldwide attacks ALPHV ransomware...

Important: kernel-livepatch-6.1.61-85.141

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The function nfttransgccatchall did not remove the catchall set element from the catchalllist when the argument sync is true, making it possib...