5436 matches found
Information Disclosure
github.com/aws/aws-sdk-go is vulnerable to information disclosure. The vulnerability exists due to the unencrypted md5 plaintext hash in the library's metadata, allowing an attacker who has read access to the encrypted S3 bucket to recover the plaintext without accessing the encryption key...
Information Disclosure
github.com/aws/aws-sdk-go is vulnerable to information disclosure. An attacker who has write access to the target S3 bucket can reveal the information of the decryption failures through the endpoint. when the CBC option is chosen as a content cipher...
Critical Photon OS Security Update - PHSA-2022-3.0-0361
Updates of 'mariadb', 'linux-aws', 'linux', 'strongswan', 'linux-secure', 'linux-esx', 'linux-rt', 'apache-tomcat', 'go' packages of Photon OS have been released...
GO-2022-0646 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...
GHSA-F5PG-7WFW-84Q9 CBC padding oracle issue in AWS S3 Crypto SDK for golang
Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures without revealing the plaintext...
Duplicate Advisory: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6jvc-q2x7-pchv. This link is maintained to preserve external references. Original Description Summary The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker...
GHSA-76WF-9VGP-PJ7W Duplicate Advisory: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6jvc-q2x7-pchv. This link is maintained to preserve external references. Original Description Summary The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker...
GHSA-7F33-F4F5-XWGW In-band key negotiation issue in AWS S3 Crypto SDK for golang
Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures without revealing the plaintext...
In-band key negotiation issue in AWS S3 Crypto SDK for golang
Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures without revealing the plaintext...
Use of a Broken or Risky Cryptographic Algorithm
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...
Use of a Broken or Risky Cryptographic Algorithm
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...
Improper Neutralization
Improper Neutralization in github.com/aws/aws-sdk-go/service/s3/s3crypto...
Critical Photon OS Security Update - PHSA-2022-4.0-0152
Updates of 'linux-aws', 'linux-secure', 'strongswan', 'linux-esx', 'linux', 'linux-rt' packages of Photon OS have been released...
AWS-Loot - Pull Secrets From An AWS Environment
Searches an AWS environment looking for secrets, by enumerating environment variables and source code. This tool allows quick enumeration over large sets of AWS instances and services. Install pip install -r requirements.txt An AWS credential file .aws/credentials is required for authentication t...
Critical Photon OS Security Update - PHSA-2022-0361
Updates of 'linux-aws', 'linux-secure', 'linux', 'apache-tomcat', 'linux-rt', 'linux-esx', 'go', 'strongswan', 'mariadb' packages of Photon OS have been released...
Five Takeaways from FlexBooker’s Data Breach
A few weeks ago, an appointment scheduling solution, FlexBooker notified its customers that it had been breached. Imperva has no specific insider knowledge into how the breach unfolded, but we can learn a lot from FlexBooker’s data breach notification as well as additional related sources. In thi...
Securitas breached, 3TB of airport employee records exposed
An unsecured AWS server, found open to the public Internet, is the root cause of a huge compromise of data of airport employees in Colombia and Peru. This server, according to a report, belongs to Securitas, a Stockholm-based multinational company that provides security services like security...
Important Photon OS Security Update - PHSA-2022-0440
Updates of 'go', 'linux-aws', 'linux', 'polkit', 'linux-esx', 'apache-tomcat', 'linux-secure' packages of Photon OS have been released...
ec2-18-235-33-250.compute-1.amazonaws.com Cross Site Scripting vulnerability OBB-2358467
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...