Backstage security vulnerabilities

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. A security vulnerability exists in versions prior to Backstage 1.10.13 that stems from the possibility of accessing the contents of an entire storage bucket when using AWS S3 or GCS...

Backstage security vulnerabilities

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. Backstage 1.10.13 security vulnerability , the vulnerability stems from the TechDocs storage bucket content controlled by an attacker , able to inject in the TechDocs content can be...

PT-2024-9768 · Google +2 · Gcs +2

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-techdocs-backend versions prior to 1.10.13 Description: The issue is related to the Backstage platform, an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs, it is...

CVE-2024-44935 sctp: Fix null-ptr-deref in reuseport_add_sock().

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix null-ptr-deref in reuseportaddsock. syzbot reported a null-ptr-deref while accessing sk2-skreuseportcb in reuseportaddsock. 0 The repro first creates a listener with SOREUSEPORT. Then, it creates another listener on the...

IP Routing Management Snapin Code Execution

The vulnerability of the IP Routing Management Snapin for Windows operating systems is related to an overflow in the buffer in the “bucket”. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

IP Routing Management Snapin Code Execution

The vulnerability of the IP Routing Management Snapin for Windows operating systems is related to an overflow in the buffer in the “bucket”. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Black Hat USA 2024: AWS ‘Bucket Monopoly’ Flaw Led to Account Takeover

Black Hat USA 2024 is up and running at full pace as critical AWS vulnerabilities are exposed! Learn…...

Open edX AWS S3 Bucket Handler Information Disclosure

The vulnerability of the AWS S3 Bucket Handler component of the online training platform Open edX Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

PT-2024-5257 · Amazon · Aws S3

Name of the Vulnerable Software and Affected Versions: Open edX Platform versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper Description: The issue is related to inadequate access control in the Open edX Platform, specifically with the AWS S3 Bucket Handler component. This may all...

CVE-2024-41806: Improper Access Control

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

Malicious code in sap-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9012927afba575f7238a84997d4c3987b6dfa74ec9e0bd0c1a1535eeffa6298f The OpenSSF Package Analysis project identified 'sap-bucket' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7634 Malicious code in sap-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9012927afba575f7238a84997d4c3987b6dfa74ec9e0bd0c1a1535eeffa6298f The OpenSSF Package Analysis project identified 'sap-bucket' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

WebAudio Code Execution

The vulnerability of WebAudio elements in Google Chrome and Microsoft Edge is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

BNbin2bn Heap Buffer Overflow DoS

The vulnerability of the BNbin2bn function etc/uams/uamsdhxpam.c in the implementation of the Apple File Protocol Netatalk protocol is related to buffer overflow in the “bucket” component. Exploiting this vulnerability can allow an attacker to trigger a service failure through the FPLoginExt...

Malicious code in lita_onewheel-beer-tin-bucket (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6968 Malicious code in lita_onewheel-beer-tin-bucket (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Tab Strip Control Microsoft Edge Chrome Code Execution

The vulnerability of the Tab Strip control elements in Microsoft Edge and Google Chrome is related to buffer overflows in the “bucket” mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by using a specially created HTML page...

Error: could not get determine if bucket supports versioning: Access Denied

Challenge Veeam Kasten for Kubernetes is unable to monitor or refresh the retention period of the data in the S3 bucket and cannot calculate the lock duration based on your retention setting because of this issue. This will show up as an error message in the notification bar: error: can't connect...

SUSE CVE-2022-31159

The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the...

minio -- unintentional information disclosure

Minio security advisory GHSA-95fr-cm4m-q5p9 reports: when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information...