Design/Logic Flaw

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

aws-encryption-sdk-cli (>=1.8.0, <=1.9.0), cloud-backup (1.0.0) +1 more potentially affected by CVE-2020-8897 via aws-encryption-sdk (>=1.3.7, <=1.10.1)

aws-encryption-sdk PYPI version =1.3.7, =1.8.0, =1.0.2, =1.0.17 Source cves: CVE-2020-8897 Source advisory: MEND:CVE-2020-8897...

CVE-2020-8897 Robustness weakness in AWS KMS and Encryption SDKs

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

br.com.guiabolso:hyperloop-transport (>=3.0.1, <=3.0.2), com.eoniantech:secrets-locker (>=1.0, <=1.2) +8 more potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (>=0.0.1, <=1.9.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version =0.0.1, =3.0.1, =1.0, =2.3.2, =0.3.0, =2.8.0, =2.11.1 - org.apache.ignite:ignite-aws-ext 1.0.0 - org.dreamhorizon:vertx-cron 1.0.0 - software.amazon.cloudformation:aws-cloudformation-rpdk-java-plugin 2.0.12 Source cves: CVE-2020-8897 Source...

CVE-2020-8897

CVE-2020-8897 : A weak robustness vulnerability affects the AWS Encryption SDKs for Java, Python, C and Javalcript prior to 2.0.0. The non-committing property of AES-GCM (and related AEAD ciphers) can let an attacker craft a unique ciphertext that decrypts to multiple different results, which is ...

CVE-2020-8897

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

PT-2020-20358

Name of the Vulnerable Software and Affected Versions AWS Encryption SDKs versions prior to 2.0.0 Description A weak robustness vulnerability exists in the AWS Encryption SDKs due to the non-committing property of AES-GCM and other AEAD ciphers. This allows an attacker to craft a unique ciphertex...

CVE-2020-8897: Use of a Broken or Risky Cryptographic Algorithm

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

Tfsec - Security Scanner For Your Terraform Code

tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform v0.12+ support. Example Output Installation Install with brew/linuxbrew: brew install tfsec Install with Chocolatey: choco install tfsec You can also grab the binary for your system from t...

Leonidas - Automated Attack Simulation In The Cloud, Complete With Detection Use Cases

Leonidas is a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into: A web API exposing each test case as an...

USN-4626-1: Linux kernel vulnerabilities

Simon Scannell discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use this to expose sensitive information kernel memory or gain administrative privileges. CVE-2020-27194 Moritz Lipp, Michael Schwarz,...

Important Photon OS Security Update - PHSA-2020-3.0-0160

Updates of 'linux-aws', 'mysql', 'linux', 'libarchive', 'linux-secure', 'linux-esx', 'linux-rt' packages of Photon OS have been released...

BugPoC: csp bypass leads to xss on wacky.buggywebsite.com

Summary: report will be uploaded later - need some sleeps █████████ ███ Steps To Reproduce: PoC above Thanks for the challenge. I tried to use bugpoc for everything but ended up using aws to host the js file - seemed fitting as well and served the purpose. F1065889 Impact taking over all the whac...

CVE-2020-2311

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

CVE-2020-2311

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

Design/Logic Flaw

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

CVE-2020-2311

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

CVE-2020-2311

The vulnerability CVE-2020-2311 affects Jenkins AWS Global Configuration Plugin (versions 1.5 and earlier). The root cause is a missing permission check in an HTTP endpoint that processes form submissions, enabling attackers with Overall/Read permission to replace the global AWS configuration. Im...

CVE-2020-2311

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

CVE-2020-2311: Undefined Security Weakness

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...