Design/Logic Flaw

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The...

Mail.ru: informations disclosure(Email,Numbers,Agreements, admin Sessions and more ...) through a PostgreSQL database belongs to (legium-back.corp.mail.ru)

Reported a vulnerability in legium.io cloud service, which is not part of Mail.Ru. legium.io is located outside the Mail.Ru infrastructure and does not have access to our company's product data. According to the rules in this case the service refers to Ext.O Third party project. While legium.io...

libwebp Heap Buffer Overflow RCE

The vulnerability of the libwebp library for encoding and decoding WebP images is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code by creating a specially crafted file...

libwebp Heap Buffer Overflow RCE

The vulnerability of the libwebp library for encoding and decoding WebP images is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by creating a specially crafted file...

Sifchain: Open S3 Bucket | information leakage

Hi I found an Open S3 Bucket. - POC : aws s3 ls s3://amazon-eks/ Source : https://github.com/Sifchain/sifnode/blob/bebbe9883560bbde4f452f81a2d85bdbc243636a/deploy/rake/dependencies.rake21 regards oos Impact information leakage...

PT-2024-11098

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an out-of-bound access in the uclamp component of the Linux kernel. Util-clamp places tasks in different buckets based on their clamp values for performance...

Automox Alive Automox Agent Access Control Error Vulnerability

Automox Alive Automox Agent is an application from the Automox Alive community. An agent software. An Access Control Error vulnerability exists in versions prior to Automox Agent 31 that stems from the use of inadequately protected S3 bucket endpoints to store sensitive files, which can be...

U.S. Dept Of Defense: S3 bucket listing/download

It's possible to get a listing and download every file in the S3 bucket ██████████ and ███████ . Supporting Material/References https://hackerone.com/reports/278191 Impact An attacker can download files that are not intended to be public, both buckets are very big. An attacker can increase...

CVE-2021-26909

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

CVE-2021-26909

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

Code injection

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

CVE-2021-26909 Automox Agent Guessable S3 Bucket Endpoint

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

PT-2021-17167

Name of the Vulnerable Software and Affected Versions: Automox Agent versions prior to 31 Description: The issue concerns an insufficiently protected S3 bucket endpoint used for storing sensitive files. This could potentially be brute-forced by an attacker, allowing them to subvert an...

CVE-2021-26909: Improper Access Control

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

SUSE: Security Advisory (SUSE-SU-2020:1748-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

alcali (>=2018.3.4, <=3000.1.0), archivebox (>=0.4.6, <=0.4.21) +72 more potentially affected by CVE-2021-28658 via django (>=3.0.0rc1, <=3.0.11)

django PYPI version =3.0.0rc1, =2018.3.4, =0.4.6, =0.1.3, =0.1.3, =0.3.0, =0.0.1, =0.1.1, =0.0.1, =1.2.0, =1.2.3 - deustest2022 1.0.0 - django-account-rcg-chandu 0.1.0 - django-account-rcgchandu 0.2.0 - django-acsecure 0.1.3 - django-admin-custom-filters 0.1.0 and more Source cves: CVE-2021-28658...

diffMaxMinRuntime gets default value of 0

Email address [email protected] Handle paulius.eth Eth address 0x523B5b2Cc58A818667C22c862930B141f85d49DD Vulnerability details uint256 public diffMaxMinRuntime; This variable is never set nor updated so it gets a default value of 0. Impact diffMaxMinRuntime with 0 value is making the calculatio...

Acronis: Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com]

Summary Hello, @acronis Team I hope you all doing well. during My recon, I found OPEN S3 BUCKET http://acronis.1.s3.amazonaws.com and this BUCKET has an ZIP file . and this file contains sensitive information about the internal system of Acronis. This Zip file Is from 2018. And it looks like it w...

Marketing firm CallX exposed customers data including call recordings

By Habiba Rashid CallX was using an unsecured Amazon Web Services S3 bucket to store audio client files. This is a post from HackRead.com Read the original post: Marketing firm CallX exposed customers data including call recordings...

alcali (>=2018.3.4, <=3000.1.0), archivebox (>=0.4.6, <=0.4.21) +59 more potentially affected by CVE-2021-23336 via django (>=3.0.0, <=3.0.11)

django PYPI version =3.0.0, =2018.3.4, =0.4.6, =0.1.3, =0.0.1, =1.2.0, =0.2.0, =0.2.1, =0.8.0, =0.9.4 and more Source cves: CVE-2021-23336 Source advisory: SNYK:PYTHON-DJANGO-1076802...