5216 matches found
CloudBees Jenkins AWS SAM Plugin Code Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . AWS SAM Plugin is used in one of the...
Malicious Package
Overview apiotics-awsclient is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...
Malicious Package
Overview awscodedeploy-agent is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...
CVE-2020-2180
Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...
CVE-2020-2180
Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...
Remote code execution
Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...
CVE-2020-2180
Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...
CVE-2020-2180
CVE-2020-2180 affects Jenkins AWS SAM Plugin (versions 1.2.2 and earlier). The root cause is that the YAML parser did not restrict deserialization of arbitrary types, enabling remote code execution. Exploitation is feasible by a user who can configure a job or control the YAML template in an AWS ...
"Value cannot be null. Parameter name: dnsName” Error when performing Infrastructure scans in Veeam Backup for AWS
For more information about Veeam Backup for AWS considerations and limitations, please review: Veeam Backup for AWS User Guide Planning and Preparation Considerations and Limitations Challenge When performing an infrastructure scan in Veeam Backup for AWS, you receive the following error: " Faile...
PT-2020-15393 · Jenkins · Jenkins Aws Sam Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins AWS SAM Plugin versions 1.2.2 and earlier Description: The issue results from the YAML parser not being configured to prevent the instantiation of arbitrary types, leading to a remote code execution vulnerability. This vulnerability i...
Shift Well-Architecture Left. By Extension, Security Will Follow
A story on how Infrastructure as Code can be your ally on Well-Architecting and securing your Cloud environment By Raphael Bottino, Solutions Architect -- first posted as a medium article Using Infrastructure as CodeIaC for short is the norm in the Cloud. CloudFormation, CDK, Terraform, Serverles...
Important Photon OS Security Update - PHSA-2020-0230
Updates of 'linux', 'linux-esx', 'linux-aws', 'linux-secure' packages of Photon OS have been released...
Serverless Prey - Serverless Functions For Establishing Reverse Shells To Lambda, Azure Functions, And Google Cloud Functions
Serverless Prey is a collection of serverless functions FaaS, that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: Panther: AWS Lambda written in Node.js Cougar: Azure Function written in C Cheetah: Google...
Important Photon OS Security Update - PHSA-2020-0288
Updates of 'libgcrypt', 'yarn', 'python2', 'openvswitch', 'kubernetes', 'gnupg' packages of Photon OS have been released...
8x8 Bounty: Open TURN relay abuse is possible due to lack of peer access control (Critical)
NOTE: This is not an SSRF vulnerability but an open TURN relay vulnerability. Typically, this security vulnerability has at least the same impact as an SSRF. However it is considered more useful from an attacker's point of view since attacks are not restricted to HTTP. - Affects: - █████:443 -...
USN-4324-1: Linux kernel vulnerabilities
Al Viro discovered that the vfs layer in the Linux kernel contained a use- after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly expose sensitive information kernel memory. CVE-2020-8428 Shijie Luo discovered that the ext4 file system...
ubuy-newdomain-1894955118.eu-west-1.elb.amazonaws.com Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1135757 Security Researcher geeknik Helped patch 8696 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting...
Sandcastle - A Python Script For AWS S3 Bucket Enumeration
Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...