136 matches found
Malicious code in zd-css-bedrock (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f5ed19a04835661c3c757cb19d1a1a55f869af076879b44b2c84cd0e66f9fd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-263 Malicious code in zd-css-bedrock (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f5ed19a04835661c3c757cb19d1a1a55f869af076879b44b2c84cd0e66f9fd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Introducing Spring AI Amazon Bedrock Nova Integration via Converse API
The Amazon Bedrock Nova models represent a new generation of foundation models supporting a broad range of use cases, from text and image understanding to video-to-text analysis. With the Spring AI Bedrock Converse API integration, developers can seamlessly connect to these advanced Nova models a...
Bootiful Spring Boot 3.4: Spring AI
I love Spring AI. It’s an amazing project designed to bring the patterns and practices of AI engineering to the Spring Boot developer. It’s got clean idiomatic abstractions that’ll make any Sring developer feel right at home, and it has a ton of integrations with all manner of different vector...
AWS VDP: Non-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The non-production API endpoints for the bedrock-agent service failed to log to CloudTrail, resulting in silent permission enumeration. A total of 26 non-production endpoints were found that could be used with standard IAM credentials without generating CloudTrail logs. This vulnerability was...
A Single Cloud Compromise Can Feed an Army of AI Sex Bots
Organizations that get relieved of credentials to their cloud environments can quickly find themselves part of a disturbing new trend: Cybercriminals using stolen cloud credentials to operate and resell sexualized AI-powered chat services. Researchers say these illicit chat bots, which use custom...
Kibana < 8.15.1 (ESA-2024-27)
The version of Kibana installed on the remote host is prior to 8.15.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2024-27 advisory. - A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a craft...
BIT-KIBANA-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
BIT-ELK-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
CVE-2024-37288
CVE-2024-37288 affects Kibana via a YAML deserialization flaw that can lead to arbitrary code execution. Exploitation is possible without user interaction over network with low privileges, targeting environments using Elastic Security AI tools and an Amazon Bedrock connector; impact to confidenti...
CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
PT-2024-5982 · Elastic · Kibana
Name of the Vulnerable Software and Affected Versions: Elastic Kibana affected versions not specified Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that...
Boosting efficiency with Wiz's AI-driven remediation steps powered by Amazon Bedrock
Wiz introduces AI-remediation steps powered by Amazon Bedrock to empower customers to remediate risks quickly...
Expanded Coverage and AWS Compliance Pack Updates in InsightCloudSec Coming Out of AWS Re:Invent 2023
It seems like it was just yesterday that we were in Las Vegas for AWS Re:Invent, but it’s already been almost two weeks since the conference wrapped up. As is always the case, AWS unveiled a host of new services throughout the week, including advancements around serverless, artificial intelligenc...
Mozilla: Missing Function Level Access Control in Mozilla formula containsRegular Expression Denial of Service (CVE-2023-25166)
Vulnerability description not provided...
Mojang Bedrock Dedicated Server整数溢出漏洞
Mojang Bedrock Dedicated Server is an official Minecraft Bedrock Edition server software from the Swedish company Mojang. Mojang Bedrock Dedicated Server is vulnerable to an integer overflow vulnerability that can be exploited by remote attackers to cause a PurchaseReceiptPacket::read packet...