PYSEC-2021-433

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a ../ substring in a ListBucketResult element...

CVE-2021-32061

CVE-2021-32061 affects S3Scanner prior to 2.0.2. A crafted bucket can trigger a directory traversal via a ../ substring in a ListBucketResult element, potentially exposing bucket contents. This vulnerability is documented across multiple feeds (including Red Hat, CNVD, GHSA, and OSV entries) and ...

CVE-2021-32061

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a ../ substring in a ListBucketResult element...

X (Formerly Twitter): Subdomain takeover of images.crossinstall.com

Summary images.crossinstall.com points to an AWS S3 bucket that no longer exists. I was able to take control of this bucket and put my own content onto it. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing to anything...

Cosmos: Unclaimed official s3 bucket of tendermint(tendermint-packages) which is used by many other blockchain companies in their code

An unclaimed official S3 bucket of Tendermint, which was also used by many other blockchain companies and developers, was discovered. An attacker could have hosted malicious files on the bucket, causing harm to the companies or developers using it for package installation. The vulnerability has...

Adobe XMP-Toolkit-SDK Buffer Overflow

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK is related to buffer overflows in the “bucket” mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user,...

Adobe XMP-Toolkit-SDK Buffer Overflow

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK is related to buffer overflows in the “bucket” mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user,...

CVE-2021-40527

Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application...

CVE-2021-40527

Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application...

PT-2021-22922

Name of the Vulnerable Software and Affected Versions com.onepeloton.erlich versions up to and including 1.7.22 Description Exposure of sensitive information to an unauthorized actor in the mobile application allows a remote attacker to access developer files stored in an AWS S3 bucket by reading...

CVE-2021-40527: Cleartext Storage of Sensitive Information

Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application...

Phone screenshots accidentally leaked online by stalkerware-type company

pcTattleTale hasnt been very careful about securing the screenshots it sneakily takes from its victims phones. pcTattleTale markets itself as "employee and child monitoring software" that is undetectable by the device user, but it can also be used to spy on spouses and partners. It allows its...

Top 6 SEO Conferences in the USA

By Owais Sultan Here are 4 more reasons why attending an SEO conference should be on your bucket list This is a post from HackRead.com Read the original post: Top 6 SEO Conferences in the USA...

Brave Software: unclaimed s3 bucket takeover in the 3 js file located on the github page of brave software

Summary: There is a unclaimed s3 bucket i.e brave-extensions.s3.amazonaws.com located in the 3 .js file on official brave software github page https://github.com/search?q=org%3Abrave+brave-extensions+language%3AJavaScript&type=Codethe attacker can takeover the bucket and create file that is used ...

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8 there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.

...

S3 bucket mess up exposed 182GB of senior US, Canada citizens data

By Waqas The misconfigured S3 bucket was owned by SeniorAdvisor, a consumer ratings, and reviews website. This is a post from HackRead.com Read the original post: S3 bucket mess up exposed 182GB of senior US, Canada citizens data...

Affirm: Subdomain takeover of www█████████.affirm.com

Summary Hi there, assuming you want this report as your policy mentions Affirm resources with third-parties, but the scope was a little unclear. Regardless, www█████.affirm.com points to an AWS S3 bucket affirm-prod-www-cms█████████ that no longer exists. I was able to take control of this bucket...

DEBIAN-CVE-2021-38166

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAPSYSADMIN capability...

Linux Kernel Input Validation Vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from an input validation error vulnerability that stems from an integer overflow and out-of-bounds write when multiple elements are placed in a bucket...

Reddit: s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.sh

Hey team, Summary: I have found that in the code of full-build-macos.sh in rpanstudio on githubhttps://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/install-dependencies-osx.sh contains a s3 bucket which was unclaimed i.e...