Important Photon OS Security Update - PHSA-2020-0140

Updates of 'linux-rt', 'linux-esx', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...

Topcoder: SSRF to AWS file read

Summary: after seeing the disclosure it looks like the bug was not fixed properly Steps To Reproduce: copy and paste the request below and paste it into Burpsuite repeater GET...

Ubuntu: Security Advisory (USN-4489-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2019-20916 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

auto-dl (0.1.1), aws-lambda-sls (0.1.0) +53 more potentially affected by CVE-2019-20916 via pip (>=1.5.6, <=19.1.1)

pip PYPI version =1.5.6, =0.0.0, =0.1.17, =1.0.1, =1.5.114, =3.4.13, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =2.4.0, =1.5.6, =1.5.8 and more Source cves: CVE-2019-20916 Source advisory: MEND:CVE-2019-20916...

Malicious Package

maleficent contains malicious code. The code when executed in the browser would capture environment variables, OS information, network interface, AWS credentials, npm credentials and ssh keys. It also subsequently prints the information to a local file...

Ex-employee hacked Cisco’s AWS Infrastructure; erased virtual machines

By Zara Khan Sudhish Kasaba Ramesh, an Indian citizen on an H1-B visa has pleaded guilty to "Damaging Cisco’s Network." This is a post from HackRead.com Read the original post: Ex-employee hacked Ciscos AWS Infrastructure; erased virtual machines...

Authentication Bypass

github.com/hashicorp/vault is vulnerable to authentication bypass. When using the IAM AWS Auth Method, the values that are used to validate identities and roles can be manipulated, leading to authentication bypass...

CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

Authentication flaw

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. The issue is fixed in Vault releases 1.2.5, 1.3.8, 1.4.4, and 1.5.1. Public disclosures in connected sources describe an AWS IAM auth bypass via...

CVE-2020-16250: Authentication Bypass by Spoofing

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

PT-2020-14842 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer Description: The issue concerns an authentication bypass when HashiCorp Vault and Vault Enterprise are configured with the AWS IAM auth method. This could potentially allow...

AWS Recon - Multi-threaded AWS Inventory Collection Tool With A Focus On Security-Relevant Resources And Metadata

A multi-threaded AWS inventory collection tool. The creators of this tool have a recurring need to be able to efficiently collect a large amount of AWS resource attributes and metadata to help clients understand their cloud security posture. There are a handful of tools e.g. AWS Config,...

Cryptoworm infecting AWS Cloud to mine cryptocurrency

By Sudais Asif The nasty cryptoworm also installs backdoor to further pursue with nefarious purposes. This is a post from HackRead.com Read the original post: Cryptoworm infecting AWS Cloud to mine cryptocurrency...

Support for Nutanix Clusters on AWS

Nutanix Clusters on AWS runs the core Nutanix HCI stack including Nutanix AOS, AHV, and Prism, along with all Nutanix products and services on bare metal EC2 instances on Amazon Web Services AWS. This allows you to migrate or extend applications from private clouds to AWS easily. Nutanix Clusters...