CVE-2022-27198

A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27199

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27198

A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27199

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

Information disclosure

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

Directory traversal

The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft...

CVE-2022-27199

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27199

CVE-2022-27199 corresponds to a vulnerability in Jenkins CloudBees AWS Credentials Plugin (versions 189.v3551d5642995 and earlier) caused by a missing permission check. This flaw lets attackers with Overall/Read permission connect to an AWS service using an attacker-specified token, as described ...

CVE-2022-27199

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27198

A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27198

CVE-2022-27198 is a CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin (versions up to 189.v3551d5642995 and earlier). It allows attackers with Overall/Read permission to perform actions against AWS services using an attacker-specified token. The connected advisories confirm the issue...

CVE-2022-27198

A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

Server-Side Request Forgery (SSRF)

Description The fixes for CVE-2022-0767 & CVE-2022-0766 only address loopback/localhost IP addresses, this is an issue as other internal endpoints may be accessible to an attacker one of the most popular examples is 169.254.169.254 which is the AWS metadata address Proof of Concept The same as...

Microsoft Azure 'AutoWarp' Bug Could Have Let Attackers Access Customers' Accounts

Details have been disclosed about a now-addressed critical vulnerability in Microsoft's Azure Automation service that could have permitted unauthorized access to other Azure customer accounts and take over control. "This attack could mean full control over resources and data belonging to the...

Important Photon OS Security Update - PHSA-2022-0449

Updates of 'linux-aws', 'linux', 'linux-secure', 'linux-esx' packages of Photon OS have been released...

AWS Credentials Disclosure

Amazon Web Services AWS is a public cloud provider offering different hosting services for their customers. Amazon Web Services can be accessed through programmatic calls to their API by authenticating with access keys, which are a combination of both an access key ID and a secret access key...

5 Cloud Native Security Platform Must-haves

Discover 5 key security components to review and how to leverage a cloud native security platform with Mick McCluney Trend Micro and Kelly Griffin AWS...

WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress AWS S3 for WordPress Plugin – Upcasted plugin versions = 3.0.0. Solution Update the WordPress AWS S3 for WordPress Plugin – Upcasted plugin to the latest available version at least 3.0.1...

WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress AWS S3 for WordPress Plugin – Upcasted plugin versions = 3.0.0. Solution Update the WordPress AWS S3 for WordPress Plugin – Upcasted plugin to the latest available version at least 3.0.1...