CVE-2024-45816

In Backstage, the vulnerability CVE-2024-45816 affects the techdocs-backend plugin when using AWS S3 or GCS storage providers. The root cause is directory traversal through TechDocs storage access, allowing an attacker to read content across the entire storage bucket and bypass Backstage permissi...

CVE-2024-45816 Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...

CVE-2024-45816 Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...

Malicious code in tsc-aws-s3 (npm)

The package contains a postinstall script to download and execute an ELF Metasploit reverse shell...

MAL-2024-8009 Malicious code in tsc-aws-s3 (npm)

The package contains a postinstall script to download and execute an ELF Metasploit reverse shell...

CVE-2024-41806

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

CVE-2024-41806 Open edX Platform's instructor upload CSV for cohort creation not Private by Default

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

CVE-2024-41806

Open edX Platform's instructor CSV uploads for cohorts can be publicly accessible when using certain storage backends. The root cause is that uploads to AWS S3 buckets could be written with a public ACL in affected branches (master, palm, olive, nutmeg, maple, lilac, koa, juniper). A patch (commi...

CVE-2024-41806 Open edX Platform's instructor upload CSV for cohort creation not Private by Default

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

CVE-2024-41806 Open edX Platform's instructor upload CSV for cohort creation not Private by Default

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

MAL-2024-7751 Malicious code in img-aws-s3-object-multipart-copy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64fdc2d1b94cc9bdb2bee2f06bd13d0be50208d8185a82a733718d2edcdcee70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7047 Malicious code in wurl-aws-s3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wurl-aws-s3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6742 Malicious code in aws_s3-deploy (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in legacyreact-aws-s3-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60942b87c6d2334d09d059276cc2d838002e2e0f5093e53fc6819e1972e02282 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-MINIO-2023-28434 MinIO is vulnerable to privilege escalation on Linux/MacOS

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...

Optimizing Data Lakes: Streamlining Storage with Effective Object Management

Data lakes are a popular solution for data storage, and for good reason. Data lakes are flexible and cost effective, as they allow multiple query engines and many object formats without the need to manage resources like disks, CPUs, and memory. In a data lake, data is simply stored in an object...

Remote Code Execution

fsevents is vulnerable to Remote Code Execution. The vulnerability is caused by loading a fsevents binary from an arbitrary AWS S3 bucket during installation. This S3 bucket URL was vulnerable to take over by malicious actors, but a security researcher claimed the bucket URL to protect against...

GHSA-2PXW-R47W-4P8C Privilege Escalation on Linux/MacOS

Impact An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with arn:aws:s3::: permission, as well as enabled Console API access. Patches commit...

WordPress AWS S3 for WordPress Plugin – Upcasted Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)

Software AWS S3 for WordPress Plugin – Upcasted Type Plugin Vulnerable versions = 3.0.2 Fixed in 3.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fb7f2e635031 Credits Rafie...