Sandcastle - A Python Script For AWS S3 Bucket Enumeration

Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP Authorization Issues Vulnerability

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP is a baby surveillance camera. A security vulnerability exists in the CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware version 3.4.2.0919, which stems from the program's use of weak authentication for accessing TELNET...

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP Access Control Error Vulnerability

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP is a baby surveillance camera. A security vulnerability exists in the CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP using firmware version 3.4.2.0919. The vulnerability can be exploited by an attacker to access the RTSP service without...

CVE-2020-6852

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required...

Authentication flaw

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required...

Design/Logic Flaw

The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password...

CVE-2020-9349

The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password...

CVE-2020-9349

The CVE-2020-9349 entry concerns the CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919, where the RTSP service can be accessed without a password. This is documented across multiple sources in the connected data set (NVD, Red Hat, CNVD, etc.). The provided documents d...

CVE-2020-6852

CVE-2020-6852 affects CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware version 3.4.2.0919, where TELNET access uses weak authentication, allowing root privileges without a password. This vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, CVE lists) with th...

CVE-2020-6852

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required...

“Secure” cloud storage provider exposes customer data in plain-text

By Waqas A "secure" cloud storage provider not so "secure" for customers after all. Here's what happened and how it puts customers at risk. This is a post from HackRead.com Read the original post: "Secure" cloud storage provider exposes customer data in plain-text...

Kubernetes: DoS for GCSArtifact.RealAll

Hi, I'm not be goot at english, if have anything don’t understand, please contact me. Thanks! Summary: attackers can control artifactName list make google storage client download large object cause denial of service. Component Version:...

PayloadsAllTheThings

This repository is an offensive tool for API key and bucket S3 exploitation. It contains tools and exploits for various types of attacks, including CRLF injection, CSRF injection, and API key leaks. The repository includes a variety of scripts and modules for different types of attacks, such as...

9 things to consider when staff work from home unexpectedly

Many businesses are reviewing and updating their response plans currently. Some might consider closing offices. This may be an appropriate response, but have you considered the effect on employees that have never worked from home before? Security considerations can be quite different, as working ...

Business in the front, party in the back: backdoors in elastic servers expose private data

It seems like every day we read another article about a data breach or leak of cloud storage exposing millions of users' data. The unfortunate truth is that the majority of these leaks require no actual "hacking" on the part of the attacker. Most of the time, this highly confidential data is just...

The vulnerability of the NGINX component of the SoftNAS Cloud storage solution allows a hacker to gain unauthorized access to the Webadmin interface.

The vulnerability of the NGINX component of the SoftNAS Cloud storage solution is related to insufficient checking of arguments passed in the command. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the Webadmin interface...

Hackers Discovered Only After Maxing Out Victim's Cloud Storage

A border privacy win, a suspect Army app, and more of the week's top security news...

5 Places Where Hackers Are Stealthily Stealing Your Data In 2019

Skyrocketing data breaches bring incalculable losses to organizations and can cost cybersecurity executives their jobs. Here we examine the top five places in 2019 where cybercriminals are stealing corporate and government data without ever getting noticed and then learn how to avoid falling vict...

5 Places Where Hackers Are Stealthily Stealing Your Data In 2019

Skyrocketing data breaches bring incalculable losses to organizations and can cost cybersecurity executives their jobs. Here we examine the top five places in 2019 where cybercriminals are stealing corporate and government data without ever getting noticed and then learn how to avoid falling vict...

Huawei Cloud Storage Application Override Access and File Upload Vulnerability

Cloud storage is a new concept developed on the basis of the extension and derivation of cloud computing, the integrated use of distributed processing, parallel processing and grid computing and other means, the network of different types of storage devices through the application software...