1540 matches found
PT-2024-22591 · Amazon Aws · Aws-Js-S3-Explorer
Name of the Vulnerable Software and Affected Versions: Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer version 1.0.0 Description: The issue allows for XSS via a crafted S3 bucket name to index.html. This can be exploited when a user interacts with a maliciously named S3 bucket,...
CVE-2024-28823
Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...
Amazon AWS Security Breach
Amazon AWS is a cloud computing platform from the U.S.-based Amazon.com that provides a range of services including information technology infrastructure and applications, such as storage, databases, computing, machine learning, and more, to individuals, businesses, and governments. A security...
CVE-2024-28823: Improper Neutralization of Input During Web Page Generation
Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...
SUSE CVE-2021-46993
In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can le...
DEBIAN-CVE-2021-46993
In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can le...
UBUNTU-CVE-2021-46993
In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can le...
Mozilla: Insecure S3 Bucket Exposing Git Directory in Mozilla Foundation Infographics Project
Git configuration was leaked in one of the S3 buckets used by Mozilla Foundation Infographics Project. The configuration included an old Github access token which was no longer valid. We restricted access to the .git directory on the bucket...
389-ds-base Heap Buffer Overflow DoS
The vulnerability of the logentryattr function in the 389-ds-base component of the Red Hat Enterprise Linux operating system is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability can allow an attacker to cause a service failure...
RHEL 8 / 9 : Red Hat Ceph Storage 5.3 Security update (Moderate) (RHSA-2024:0745)
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0745 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage...
rgw: improperly verified POST keys
A flaw was found in rgw. This flaw allows an unprivileged user to write to any buckets accessible by a given key if a POST's form-data contains a key called 'bucket' with a value matching the bucket's name used to sign the request. This issue results in a user being able to upload to any bucket...
RGW storage service S3 get_params() Arbitrary File Upload
The vulnerability of the RGWPostObjObjStoreS3::getparams function rgwrests3.cc in the RGW storage service of the Ceph system is related to deficiencies in access control when processing bucket keys. Exploiting this vulnerability allows an attacker to bypass security restrictions and upload...
USN-6613-1 ceph vulnerability
Lucas Henry discovered that Ceph incorrectly handled specially crafted POST requests. An uprivileged user could use this to bypass Ceph's authorization checks and upload a file to any bucket...
BucketLoot - An Automated S3-compatible Bucket Inspector
BucketLoot is an automated S3-compatible Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text. The tool can scan for bucke...
Virtuozzo Hybrid Server 7.5 Update 6 (7.5.6-87)
Virtuozzo Hybrid Server 7.5 Update 6 introduces new features and provides stability, usability, and security bug fixes. Additionally, it provides a new kernel 3.10.0-1160.105.1.vz7.214.3. Vulnerability id: PSBM-151015, PSBM-153331 A critical security issue in container suspend/resume in the...
Restore Entire Bucket to Zadara Object Storage Fails With "Error: Internal error: object key is empty."
Challenge Attempting to perform an Entire Bucket Restore with the the Destination set to New Bucket when using Zadara Object Storage fails with the error: Restore job failed Error: Internal error: object key is empty. ClientId: , BucketName: Cause This issue arises from a problem related to the...
Internet Bug Bounty: Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket
A misconfiguration in the AWS CloudFront CDN configuration for rubygems.org caused content to be served from an unclaimed S3 bucket. This could have enabled an attacker to serve malicious content and affect availability. Artifactory instances were observed accessing files, presenting a potential...
CVE-2023-6017
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...
