CVE-2013-2474: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter...

ec2-18-139-53-85.ap-southeast-1.compute.amazonaws.com Cross Site Scripting vulnerability

Security Researcher thakurbivesh Helped patch 53 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting ec2-18-139-53-85.ap-southeast-1.compute.amazonaws.com website and its users...

AlertResponder - Automatic Security Alert Response Framework By AWS Serverless Application Model

AlertResponder is a serverless framework for automatic response of security alert. Overview AlertResponder receives an alert that is event of interest from security view point and responses the alert automatically. AlertResponder has 3 parts of automatic response. 1. Inspector investigates entiti...

Ruby: Source code disclosed via S3 Bucket

Summary The Ruby having an Amazon S3 bucked named http://rubyci.s3.amazonaws.com/ which lists some of their log files. Those logs having some informations to check the source code server side directories. Steps to Reproduce 1. direct to http://rubyci.s3.amazonaws.com/ which having READ Permission...

ec2-13-233-60-134.ap-south-1.compute.amazonaws.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1071371 Security Researcher thakurbivesh Helped patch 53 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting ec2-13-233-60-134.ap-south-1.compute.amazonaws.com...

s3-eu-west-1.amazonaws.com Improper Access Control vulnerability

Security Researcher Nep13371998 Helped patch 562 vulnerabilities Received 4 Coordinated Disclosure badges Received 7 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting s3-eu-west-1.amazonaws.com website and its users...

prd-medweb-cdn.s3.amazonaws.com Improper Access Control vulnerability

Security Researcher NotAkay Helped patch 1 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting prd-medweb-cdn.s3.amazonaws.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard...

How we Developed a Unified Binary Store (UBS): Part 1

Like most technology companies, VMware Carbon Black has a combination of acquired and built technologies that all utilize their own data stores. As our products have evolved to include the benefits of a centralized cloud offering, our data stores needed to similarly evolve. A new goal was formed:...

CVE-2020-2091

A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

CVE-2020-2090

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

Security feature bypass

A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

CVE-2020-2090

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

CVE-2020-2090

The CVE-2020-2090 entry pertains to a CSRF vulnerability in Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). The root cause is that form validation methods did not perform permission checks, allowing users with Overall/Read access to Jenkins to connect to an attacker-specified URL within th...

CVE-2020-2091

CVE-2020-2091 concerns the Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). A missing permission check in form validation allows users with Overall/Read access to connect to an attacker-specified URL in the AWS region using attacker-specified credentials IDs obtained via another method. The...

CSRF vulnerability and missing permission checks in ec2

ec2 1.47 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. NOTE: This...

CVE-2020-2090: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

CVE-2020-2091: Missing Authorization

A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

Razer: Aws bucket writable mobile.razer.com

The tester discovered an S3 bucked owned by Mobile that was writeable. No files were present but the permissions were incorrect and subsequently fixed. Razer appreciates the report...

Arbitrary Command Injection

aws-lambda is vulnerable to arbitrary command injection. The vulnerability exists due to the lack of sanitization on the value of config.FunctionName, allowing injection payloads to reach the exec function...