5216 matches found
Critical Photon OS Security Update - PHSA-2020-0283
Updates of 'cyrus-sasl', 'yarn', 'PyYAML' packages of Photon OS have been released...
Moderate Photon OS Security Update - PHSA-2020-0065
Updates of 'cloud-init', 'linux-esx', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...
U.S. Dept Of Defense: No ACL on S3 Bucket in [https://www.██████████/]
Summary: Hi team!, i was able to move and download all file in s3 bucket that's under ████ control cuz it didn't has ACL Step-by-step Reproduction Instructions first we will try to access all files via browser by go to this s3.amazonaws.com/files.████████ Now We Will try to download all files on...
Moderate Photon OS Security Update - PHSA-2020-3.0-0065
Updates of 'linux-aws', 'linux', 'linux-secure', 'linux-esx', 'cloud-init' packages of Photon OS have been released...
Moderate Photon OS Security Update - PHSA-2020-0282
Updates of 'cloud-init' packages of Photon OS have been released...
Performance Testing: Justifying Cost and Performance Improvements (Part 2)
As mentioned in the first blog in this series, Melanie, a performance engineer at VMware Carbon Black, built both baseline and investigative tests for the engineers that develop and maintain the company’s reputation services. Here’s a deeper look at these tests and how they helped the company...
SUSE-SU-2020:0555-1 Security update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer
This update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, python-jsonpatch, python-jsonpointer, python-scandir, python-PyYAML fixes the...
Invalid role for specified account. Status code: Forbidden
Challenge When attempting to add a custom role in the Veeam Backup for AWS console, the following error occurs: Invalid role for specified account. Status code: Forbidden Log snippet: Info CDefaultAmazonStsInfrastructure Assuming role 'arn:aws:iam::xyz:role/customrole'. Error TryInvokeAsync...
RSAC 2020: Smart Baby Monitor Vulnerable to Remote Hackers
SAN FRANCISCO – Researchers have discovered a slew of security vulnerabilities in a popular baby monitor, which if exploited allows attackers to remotely access the camera’s video footage. The vulnerabilities were discovered in the iBaby Monitor M6S connected baby camera by researchers with...
UPDATE: Prowler 2.2.0
Prowler 2.2.0 was released a couple of days ago. A lot has changed my last post about this AWS CIS Benchmark tool. This new incorporates more than 130 checks, many cool new features such as support for FreeBSD, lots of improvements and fixes in documentation and code! What is Prowler? Prowler is ...
Glassdoor: Access to Glassdoor's Infra (AWS) and BitBucket account through leaked repo
AWS credentials associated to a Glassdoor employee was exposed via publicly accessible repo. This keys gave access to a particular account on AWS related to big data. We have removed and rotated the keys since and corrected the permissions on the repo. Thanks @prateek0490 for detecting and lettin...
Free import of AWS CloudTrail logs through June 2020 and other exciting Azure Sentinel updates
SecOps teams are increasingly challenged to protect assets across distributed environments, analyze the growing volume of security data, and prioritize response to real threats. As a cloud-native SIEM solution security information and event management, Azure Sentinel uses artificial intelligence ...
USN-4285-1: Linux kernel vulnerabilities
It was discovered that the Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors. A local attacker could use this to expose sensitive information. CVE-2019-14615 It was discovered that the HSA Linux kernel driver for AMD GPU devices did not...
Gospider - Fast Web Spider Written In Go
GoSpider - Fast web spider written in Go Installation go get -u github.com/jaeles-project/gospider Features Fast web crawling Brute force and parse sitemap.xml Parse robots.txt Generate and verify link from JavaScript files Link Finder Find AWS-S3 from response source Find subdomains from respons...
GHSA-934X-72XH-5HRG OS command injection in aws-lambda
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...
OS command injection in aws-lambda
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...
This Week in Security News: February 2020 Patch Tuesday Update and Misconfigured AWS S3 Bucket Leaks 36,000 Inmate Records
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the more than 140 February Patch Tuesday updates from Microsoft and Adobe. Also, read about how an unsecured and unencrypted...
CVE-2019-14652
explorer.js in Amazon AWS JavaScript S3 Explorer aka aws-js-s3-explorer v2 alpha before 2019-08-02 allows XSS in certain circumstances...
