X (Formerly Twitter): URGENT - Subdomain Takeover on users.tweetdeck.com , the same issue of report #32825

hi twitter security team . This is an urgent issue the same of report 32825 Your subdomain users.tweetdeck.com is pointing to AWS S3, but no bucket was connected to it. an attacker can claim the domain and takeover the full subdomain. Please fix it as soon as possible , and let me know if you nee...

Amazon Linux AMI : rsyslog (ALAS-2014-445)

A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local attacker, or a remote attacker able to connect to the rsyslog port, could use this flaw to crash the rsyslog daemon. CVE-2014-3634 C Tenable Network Security, Inc. The descriptive...

X (Formerly Twitter): URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWS

Hi, This is an urgent issue and I hope you will act on it likewise. Your subdomain media.vine.co is pointing to AWS S3, but no bucket was connected to it. Actually, the reason to it is due to the CNAME of the meda.vine.co-DNS-entry: media.vine.co - media.vine.co is an alias for...

Amazon Linux AMI : nss (ALAS-2014-424)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. C Tenable Network Security, Inc. The descriptive tex...

Sports Accelerator Suite 2.0 - (news_id) Remote SQL Injection Vulnerability

No description provided by source. Sports Accelerator Suite v2.0 newsid Remote SQL Injection Vulnerability Vendor: Athlete Web Services, Inc. / AWS Sports Product Web Page: http://www.athletewebservices.com Summary: Content Management System PHP+MySQL. Description: The CMS is vulnerable to an SQL...

AWS XMS 2.5 (importer.php, what param) - Directory Traversal Vulnerability

No description provided by source...

Amazon AWS Compliance Checks

Binary data amazonawscompliancecheck.nbin...

CVE-2012-3427

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

Input validation

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

CVE-2012-3427

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

CVE-2012-3427

CVE-2012-3427 affects Red Hat’s Red Hat Enterprise Linux 6 on EC2 with the JBoss Enterprise Application Platform 5.1.2 EC2 AMI. The issue is that /var/cache/jboss-ec2-eap/ had world-readable permissions (part of the 755 mode), allowing local users to read potentially sensitive data such as AWS cr...

AWS Elastic Beanstalk Code Execution

Form:http://en.wooyun.org/bugs/wooyun-2013-040 Abstract£º AWS Elastic Beanstalk is an even easier way for you to quickly deploy and manage applications in the AWS cloud. elasticbeanstalk subdomain exists Struts2 code execution . Details£º poc return /ok:...

[SECURITY] Fedora 18 Update: eucalyptus-3.2.2-1.fc18

Eucalyptus is a service overlay that implements elastic computing using existing resources. The goal of Eucalyptus is to allow sites with existing clusters and server infrastructure to co-host an elastic computing service that is interface-compatible with Amazon AWS. This package contains the...

Amazon Web Services, aws_portal / remote code execution

awsportal is a tool to Create new AWS instances, volumes for QA and Development purposes with the help of the AWS APIs, all in real-time. this tool has a file which is vulnerable to remote code execution link to source : https://github.com/ejlax/rsportal/ file rs-api-start.php uses getparameter...

Amazon Linux AMI : bind (ALAS-2013-214)

A denial of service flaw was found in BIND. A remote attacker could use this flaw to send a specially crafted DNS query to named that, when processed, would cause named to crash when rejecting the malformed query. CVE-2013-4854 C Tenable Network Security, Inc. The descriptive text and package...

[Nimbostratus] Tools for fingerprinting and exploiting Amazon cloud infrastructures

Nimbostratus are tools for fingerprinting and exploiting Amazon cloud infrastructures. Nimbostratus is the first toolset to help you in the process of pivoting in Amazon AWS clouds Features Enumerate permissions to AWS services for current IAM role Use poorly configured IAM role to create new AWS...

Fedora Update for nodejs-aws-sign FEDORA-2013-11780

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for nodejs-aws-sign FEDORA-2013-11780

Check for the Version of nodejs-aws-sign OpenVAS Vulnerability Test Fedora Update for nodejs-aws-sign FEDORA-2013-11780 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modif...

[SECURITY] Fedora 18 Update: nodejs-aws-sign-0.3.0-1.fc18

Simple module to calculate Authorization header for Amazon AWS REST request s...

Path Traversal in AWS XMS

Advisory ID: HTB23147 Product: AWS XMS Vendor: http://www.aws-dms.com Vulnerable Versions: 2.5 and probably prior Tested Version: 2.5 Vendor Notification: March 6, 2013 Vendor Patch: March 16, 2013 Public Disclosure: March 27, 2013 Vulnerability Type: Path Traversal CWE-22 CVE Reference:...