The 8220 Cryptomining Gang massively expands Cloud Botnets

Threat Level Actor Report For a detailed advisory, download the pdf file here Summary The 8220 gang has significantly expanded their cloud bot armies around the world, targeting AWS, Azure, GCP, Alitun, and QCloud cloud service hosts. The group is being detected using a new version of the IRC...

Important Photon OS Security Update - PHSA-2022-4.0-0214

Updates of 'linux-esx', 'libtiff', 'linux-aws', 'lua', 'ImageMagick', 'go', 'linux', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0214

Updates of 'linux-esx', 'linux-aws', 'linux', 'linux-rt', 'linux-secure', 'go', 'libtiff', 'ImageMagick' packages of Photon OS have been released...

Use Qualys ­­Flow to Automate Detection & Remediation with No-code Workflows

The threat landscape is rapidly and constantly evolving. New software vulnerabilities and service misconfigurations are discovered daily, and exploits targeting them are often released within hours. For effective security, pursuing the automation of both detection and remediation processes is...

CVE-2022-30570

The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with network access to obtain read access to application information on the...

Design/Logic Flaw

The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with network access to obtain read access to application information on the...

CVE-2022-30570 TIBCO Data Virtualization Access Control Vulnerability

The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with network access to obtain read access to application information on the...

CVE-2022-30570

CVE-2022-30570 affects TIBCO Data Virtualization (TDV) and TDV for AWS Marketplace in the Column Based Security component. A low-privileged attacker with network access can obtain read access to application information on the affected system. Affected releases: TDV 8.5.2 and earlier; TDV for AWS ...

Wallarm extends AWS API security with the official Terraform module

Wallarm API Security solution is now available in AWS as an official Terraform module, with a full feature set including autoscaling groups, API Gateway connector, mirroring, and agentless out-of-band deployments. To address modern cloud-native threats, API security vendor Wallarm released extend...

Deploy tCell More Easily With the New AWS AMI Agent

Rapid7's tCell is a powerful tool that allows you to monitor risk and protect web applications and APIs in real time. Great! It's a fundamental part of our push to make web application security as strong and comprehensive as it needs to be in an age when web application attacks account for roughl...

Path Traversal

aws-java-sdk-s3 is vulnerable to path traversal. The vulnerability exists due to the insufficient guard logic used for the download directory in the leavesRoot function of TransferManager.java, allowing an attacker to access files from the S3 bucket that is one level up in the file system by...

aws-marketing.de Cross Site Scripting vulnerability OBB-2791989

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Fedora: Security Advisory for golang-github-aws-lambda (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-uber-athenadriver (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[Bypass] Cross-site Scriptin (XSS) via file upload

🔒️ Requirements Privileges: User. 📝 Description I found a bypass to this report by uploading the file with "public": true, parameter. This is due to the fact that AWS bucket public folder does not auto download files when we access them. 🕵️‍♂️ Proof of Concept Step 1: Go your outline home and...

[SECURITY] Fedora 35 Update: mass3-0-0.6.20200627gite1d5f1a.fc35

Quickly enumerate through a pre-compiled list of AWS S3 buckets using DNS instead of HTTP with a list of DNS resolvers and multi-threading...

[SECURITY] Fedora 35 Update: golang-github-uber-athenadriver-1.1.12-5.fc35

A fully-featured AWS Athena database driver...

[SECURITY] Fedora 35 Update: golang-github-aws-lambda-1.24.0-3.fc35

Libraries, samples and tools to help Go developers develop AWS Lambda functions...

Important Photon OS Security Update - PHSA-2022-0495

Updates of 'linux', 'linux-secure', 'linux-aws', 'linux-esx' packages of Photon OS have been released...

Partial Path Traversal in com.amazonaws:aws-java-sdk-s3

Overview A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java v1. Applications using the SDK control the destinationDirectory argument, but S3 object keys are determined by the application that uploaded the...