1535 matches found
SUSE CVE-2023-43040
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...
UBUNTU-CVE-2023-43040
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...
MinIO < RELEASE.2023-03-20T20-16-18Z Multiple Vulnerabilities
The version of MinIO installed on the remote host is prior to RELEASE.2023-03-20T20-16-18Z. It is, therefore, affected by multiple vulnerabilities: - When deployed in a cluster/in distributed mode MinIO returns all environment variables, including 'MINIOSECRETKEY' and 'MINIOROOTPASSWORD', resulti...
MinIO Security Feature Bypass Vulnerability
MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket to conduct privilege escalation. To carry out this attack, the attacker requires...
GHSA-2PXW-R47W-4P8C Privilege Escalation on Linux/MacOS
Impact An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with arn:aws:s3::: permission, as well as enabled Console API access. Patches commit...
VulnCheck KEV: CVE-2023-28434
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...
New InsightCloudSec Compliance Pack for CIS AWS Benchmark 2.0.0
The Center for Internet Security CIS recently released version two of their AWS Benchmark. CIS AWS Benchmark 2.0.0 brings two new recommendations and eliminates one from the previous version. The update also includes some minor formatting changes to certain recommendation descriptions. In this...
New InsightCloudSec Compliance Pack for CIS AWS Benchmark 2.0.0
The Center for Internet Security CIS recently released version two of their AWS Benchmark. CIS AWS Benchmark 2.0.0 brings two new recommendations and eliminates one from the previous version. The update also includes some minor formatting changes to certain recommendation descriptions. In this...
PT-2023-8462
Name of the Vulnerable Software and Affected Versions IBM Spectrum Fusion HCI versions 2.5.2 through 2.7.2 Description The issue is related to improper bucket access in the RGW service of the Ceph data storage system. It allows an attacker to perform unauthorized actions by exploiting the lack of...
New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries
In what's a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 buckets to serve rogue binaries without altering the modules themselves. "Malicious binaries steal the user IDs, passwords, local machine...
New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries
In what's a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 buckets to serve rogue binaries without altering the modules themselves. "Malicious binaries steal the user IDs, passwords, local machine...
GHSA-7CGC-FJV4-52X6 Malware in pre-build binaries of bignum
Impact bignum releases from v0.12.2 to v0.13.0 inclusive used node-pre-gyp to optionally download pre-built binary versions of the addon. These binaries were published on a now-expired S3 bucket which has since been claimed by a malicious third party which is now serving binaries containing malwa...
PT-2023-32989
Name of the Vulnerable Software and Affected Versions bignum versions 0.12.2 through 0.13.0 Description The issue concerns the use of node-pre-gyp to download pre-built binary versions of the addon. These binaries were previously hosted on an S3 bucket that has since expired and been claimed by a...
Kiddoware Kids Place Parental Control Android App 3.8.49 XSS / CSRF / File Upload Vulnerabilities
======================================================================= title: Multiple Vulnerabilities product: Kiddoware Kids Place Parental Control Android App vulnerable version: =3.8.49 fixed version: 3.8.50 or higher CVE number: CVE-2023-28153, CVE-2023-29078, CVE-2023-29079 impact: High...
Exposure of Resource to Wrong Sphere
Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere by loading a binary from an insecure hardcoded S3 bucket URL, which was demonstrated by an ethical hacker to be susceptible to takeover by malicious...
Linux net/core/sock_map Heap Buffer Overflow DoS
The vulnerability of the sockhashdeleteelem function in the net/core/sockmap.c module of the Linux kernel is related to incorrect serialization of the resource htab-bucketsi.lock. Exploiting this vulnerability could allow an attacker to trigger a service denial-of-service attack...
Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location
Summary An unsafe extraction is being performed using shutil.unpackarchive from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. This vulnerability is sometimes called a TarSlip or a ZipSlip variant. Details Unpacking files using the...
Privilege Escalation
github.com/minio/minio is vulnerable to Privilege Escalation. An attacker is able to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To achieve this, the attacker needs credentials with arn:aws:s3::: permission and...
Buffer Overflow
Overview Affected versions of this package are vulnerable to Buffer Overflow due to the variable bucket pointing to an inaccessible address. The issue can be triggered in the function PackLinuxElf64::invertptdynamic at plxelf.cpp:5239. Remediation Upgrade upx to version 4.2.1 or higher. Reference...
CVE-2021-43313
A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invertptdynamic at plxelf.cpp:1688...