8330 matches found
Critical Photon OS Security Update - PHSA-2020-0272
Updates of 'unbound', 'libxml2', 'libarchive', 'salt' packages of Photon OS have been released...
F5 Networks BIG-IP : BIG-IP TMM AWS vulnerability (K00025388)
While processing specifically crafted traffic using the default 'xnet' driver, BIG-IP Virtual Edition VE instances hosted in Amazon Web Services AWS may experience a Traffic Management Microkernel TMM restart. CVE-2020-5856 Impact A remote attacker may be able to perform a denial-of-service DoS...
Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service
When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...
Prepare for Cisco, CompTIA, and More IT Certifications with this Bundle
Exams are pretty important in professional IT. You can have all the practical knowledge in the world, but technical recruiters want to see certificates. If you want to improve your resume, the Complete 2020 IT Certification Exam Prep Mega Bundle will help you ace nine of the most important exams...
Dufflebag - Search Exposed EBS Volumes For Secrets
Dufflebag is a tool that searches through public Elastic Block Storage EBS snapshots for secrets that may have been accidentally left in. You may be surprised by all the passwords and secrets just laying around! The tool is organized as an Elastic Beanstalk "EB", not to be confused with EBS...
Verodin Director Web Console 3.5.4.0 Password Disclosure
Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Discovery Date: 2019-01-31 Exploit Author: Nolan B. Kennedy nxkennedy Vendor Homepage: https://www.verodin.com/ Software Link : https://www.verodin.com/demo-request/demo-request-form Tested Versions...
Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)
Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Discovery Date: 2019-01-31 Exploit Author: Nolan B. Kennedy nxkennedy Vendor Homepage: https://www.verodin.com/ Software Link : https://www.verodin.com/demo-request/demo-request-form Tested Versions...
Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)
Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Discovery Date: 2019-01-31 Exploit Author: Nolan B. Kennedy nxkennedy Vendor Homepage: https://www.verodin.com/...
How we Developed a Unified Binary Store (UBS): Part 2
As you may have seen in Part One of this blog, one of our engineering teams at VMware Carbon Black was tasked with building a Unified Binary Store UBS that would increase operational efficiencies and serve as a centralized source of data across products. We were able to build the platform in thre...
Razer: AWS subdomain Takeover at estore.razersynapse.com
The tester discovered the razersynapse.com domain was vulnerable to a subdomain takeover. Although this is out of scope of our program, we appreciate the tester bringing this to our attention...
Ubuntu: Security Advisory (USN-4254-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-4253-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-4255-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Automating API Security in the Cloud
These days, the most common way for services to communicate and transfer data is by using APIs. However, broken, exposed, or hacked APIs are the cause of some of the latest major data breaches, as they have the potential to expose sensitive data for public consumption. Securing your APIs is...
SUSE-SU-2020:0251-1 Security update for aws-cli
This update for aws-cli to version 1.16.297 fixes the following issues: Security issue fixed: - CVE-2018-15869: Fixed an permission handling issue where an unexpected AMI could potentially be used bsc1105988. Non-security issues fixed: - Fixed an issue with the CLI client, where a...
CVE-2013-2474
Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter...
Directory traversal
Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter...
CVE-2013-2474
Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter...
CVE-2013-2474
AWS XMS 2.5 is affected by CVE-2013-2474, a directory traversal vulnerability in importer.php?what that allows remote attackers to read arbitrary files. The root cause is insufficient filtration of the what parameter before it is used in PHP file() (and related code paths), enabling access to sen...
PT-2020-7389
Name of the Vulnerable Software and Affected Versions: AWS XMS version 2.5 Description: A directory traversal issue allows remote attackers to view arbitrary files by manipulating the what parameter. Recommendations: For AWS XMS version 2.5, avoid using the what parameter in affected API endpoint...