Regular Expression Denial Of Service (ReDoS)

aws-lambda-multipart-parser is vulnerable to regular expression denial of service ReDoS attacks. These attacks are possible through a multipart/form-data boundary string and allows attackers to inject and execute arbitrary code...

CVE-2018-7560

index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service ReDoS issue via a crafted multipart/form-data boundary string...

CVE-2018-7560

The CVE-2018-7560 issue affects the npm package aws-lambda-multipart-parser prior to version 0.1.2 by Anton Myshenin. The vulnerability is a Regular Expression Denial of Service (ReDoS) in index.js triggered by specially crafted multipart/form-data boundary strings, potentially enabling a denial ...

CVE-2018-7560

index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service ReDoS issue via a crafted multipart/form-data boundary string...

CVE-2018-7560

index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service ReDoS issue via a crafted multipart/form-data boundary string...

PT-2018-18155

Name of the Vulnerable Software and Affected Versions aws-lambda-multipart-parser versions prior to 0.1.2 Description The issue is a Regular Expression Denial of Service ReDoS problem that can be triggered by a crafted multipart/form-data boundary string. This can affect the index.js file in the...

CVE-2018-7560: Improper Input Validation

index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service ReDoS issue via a crafted multipart/form-data boundary string...

Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant’s Data

By Waqas Another day, another AWS Bucket exposed to the public - This This is a post from HackRead.com Read the original post: Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant's Data...

NEW: Vulnerability and Assessment Scanning for Your AWS Cloud Databases

Scuba is a free and easy-to-use tool that uncovers hidden security risks. Scuba is frequently updated with content from Imperva’s Defense Center researchers. With Scuba you can: Scan enterprise databases for vulnerabilities and misconfigurations Identify risks to your databases Get recommendation...

Important Photon OS Security Update - PHSA-2018-0109

Updates of 'dnsmasq', 'libtasn1' packages of Photon OS have been released...

Qualys Cloud Platform 2.32 New Features

This release of the Qualys Cloud Platform version 2.32 includes updates and new features for AssetView, EC2 Connector, File Integrity Monitoring, Indication of Compromise, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. Post update...

GSA Bounty: Subdomain Takeover due to unclaimed domain pointing to AWS

Note: I know this is on an out of scope domain, however felt it should still be raised as it was the only subdomain of data.gov to be vulnerable. Issue Details The consultant identified that subdomain https://18f.domains.api.data.gov/ is pointing to dn9rrjaiux2m0.cloudfront.net via a DNS CNAME...

Critical Photon OS Security Update - PHSA-2018-0016

Updates of 'linux-aws', 'linux-secure', 'linux-esx', 'binutils', 'linux', 'libtiff', 'curl', 'postgresql' packages of Photon OS have been released...

Snapchat: Takeover 2 MAIN DOMAINS of a company Acquired by Snapchat

Hi, As you may realize I noted "Domain" and not subdomain because actually, I was able to take over the MAIN domain of a company Acquired by Snapchat. As you can see in the screenshot below, when you type "Addlive" in Google https://goo.gl/EAxBaj , the first two results will be: F261984 First one...

Serverless, Low Cost, Threat Intel Aggregation: ElasticIntel

ElasticIntel is serverless, low cost, threat intel aggregation for enterprise or personal use, backed by ElasticSearch. It is an alternative to expensive threat intel aggregation platforms which ingest the same data feeds you could get for free. ElasticIntel is designed to provide a central,...

RHEL 6 : jboss-ec2-eap (RHSA-2018:0275)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0275 advisory. The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services AWS Elastic...

Important: Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update

An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important Photon OS Security Update - PHSA-2018-0015

Updates of 'linux', 'linux-esx', 'linux-aws', 'linux-secure' packages of Photon OS have been released...

January 24, 2018 – Morning Cyber Coffee Headlines – “Taco” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 24, 2018 - Headlines Carbon Black in the News: Amazon Web Services Buys...

Meltdown and Spectre Attacks | Cloud Foundry

Severity Advisory/Critical Description Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a maliciou...