CVE-2025-1969

Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...

GHSA-GHW8-3XQW-HHCJ vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-istio-csr, cert-exporter, step-issuer, aws-privateca-issuer, cert-manager-webhook-pdns...

CVE-2024-12401 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-istio-csr, cert-exporter, step-issuer, aws-privateca-issuer, cert-manager-webhook-pdns...

GHSA-GHW8-3XQW-HHCJ vulnerabilities

Vulnerabilities for packages: step-issuer-fips, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-exporter-fips, cert-manager-webhook-pdns-fips, step-issuer, cert-exporter, cert-manager-cmctl, aws-privateca-issuer, aws-privateca-issuer-fips, cert-manager-cmctl-fips...

GHSA-F9JG-8P32-2F55 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips...

CVE-2024-12401 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-exporter-fips, cert-manager-webhook-pdns-fips, step-issuer, cert-exporter, cert-manager-cmctl, aws-privateca-issuer, aws-privateca-issuer-fips, cert-manager-cmctl-fips...

Server-side Request Forgery (SSRF)

Overview io.spinnaker.clouddriver:clouddriver-aws is a Spinnaker Clouddriver Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper restrictions on user-supplied URLs when fetching data. An attacker can access internal resources, extract sensitive...

Malicious code in chalk-aws (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-192895 Malicious code in chalk-aws (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-14762

A flaw was found in the AWS SDK for Ruby, an open-source client-side encryption library. A user with write access to an S3 Simple Storage Service bucket can exploit a missing cryptographic key commitment. This allows the introduction of a new Encrypted Data Key EDK that decrypts to different...

CVE-2025-14761

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgra...

CVE-2025-14762

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue,...

CVE-2025-14760

Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgra...

CVE-2025-14760

Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgra...

CVE-2025-14503

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...

Ubuntu: Security Advisory (USN-7931-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7930-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-14503 Overly Permissive Trust Policy in Harmonix on AWS EKS

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...

CVE-2025-14503 Overly Permissive Trust Policy in Harmonix on AWS EKS

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...

CVE-2025-14503 Overly Permissive Trust Policy in Harmonix on AWS EKS

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...