CVE-2023-6017

CVE-2023-6017 concerns H2O with a reference to an S3 bucket that no longer exists, which could allow an attacker to take over the S3 bucket URL. The connected sources (NVD/Red Hat/PRION-like records) confirm the same vulnerability description across multiple feeds, indicating an issue where an ou...

CVE-2023-6017 H2O S3 Bucket Takeover

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

H2O Security Breach

H2O is an in-memory platform for distributed, scalable machine learning. H2O suffers from a security vulnerability that stems from allowing an unauthorized attacker to access the S3 bucket and execute remote code...

S3 Bucket can lead to spread of malicious R package

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

PT-2023-32480

Name of the Vulnerable Software and Affected Versions H2O affected versions not specified Description The issue allows an attacker to take over an S3 bucket URL due to a reference to a non-existent S3 bucket. Recommendations At the moment, there is no information about a newer version that contai...

CVE-2023-6017: Undefined Security Weakness

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

OESA-2023-1761 ceph security update

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage. Security Fixes: A flaw was found in rgw. This flaw allows an unprivileged user to write to any buckets accessible by a given key if a POST's...

CVE-2023-45279

Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...

CVE-2023-45280

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...

CVE-2023-45279

Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...

CVE-2023-45280

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...

Design/Logic Flaw

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...

Design/Logic Flaw

Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...

CVE-2023-45277

Yamcs 5.8.6 is vulnerable to directory traversal issue 1 of 2. The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files...

PT-2023-29483

Name of the Vulnerable Software and Affected Versions Yamcs version 5.8.6 Description The issue allows for Cross-Site Scripting XSS due to the ability to upload arbitrary files, including HTML files containing JavaScript, to the primary storage mechanism, known as a Bucket. An attacker can upload...

CVE-2023-45279

Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...

Yamcs Cross-Site Scripting Vulnerability

Yamcs is an open source software framework from Yamcs Open Source. It is used to command and control spacecraft, satellites, payloads, ground stations and ground equipment. A security vulnerability exists in Yamcs version 5.8.6, which stems from the fact that it is possible to upload a display...

PT-2023-29482 · Yamcs · Yamcs

Name of the Vulnerable Software and Affected Versions: Yamcs version 5.8.6 Description: The issue allows for Cross-Site Scripting XSS attacks. It comes with a Bucket as its primary storage mechanism, which allows for the upload of any file. There's a way to upload a display referencing a maliciou...

Medium: ceph-common

Issue Overview: A flaw was found in rgw. This flaw allows an unprivileged user to write to any buckets accessible by a given key if a POST's form-data contains a key called 'bucket' with a value matching the bucket's name used to sign the request. This issue results in a user being able to upload...

CVE-2023-45280: Improper Neutralization of Input During Web Page Generation

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...