CVE-2024-52314

CVE-2024-52314 relates to data.all. Multiple connected sources describe a vulnerable scenario where a data.all admin team member with access to a customer‑owned AWS account can potentially extract user data from data.all application logs by scanning CloudWatch logs for operations interacting with...

CVE-2024-52314 data.all admin user may access potentially sensitive data stored by producers via logs

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

CVE-2024-52314 data.all admin user may access potentially sensitive data stored by producers via logs

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

CVE-2024-52314 data.all admin user may access potentially sensitive data stored by producers via logs

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

CVE-2024-52314: Incorrect Authorization

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

data.all 安全漏洞

data.all is an open source development framework from data-dot-all open source. A security vulnerability exists in data.all that stems from the fact that a member of the data.all management team with access to an AWS account owned by a customer deploying data.all may be able to extract user data...

PT-2024-35174

Name of the Vulnerable Software and Affected Versions data.all affected versions not specified Description A data.all admin team member with access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs via CloudWatch log...

MAL-2024-9546 Malicious code in client-cloudwatch-logs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in client-cloudwatch-logs (npm)

--- -= Per source details. Do not edit below this line.=-...

GHSA-G8M5-722R-8WHQ vulnerabilities

Vulnerabilities for packages: celeborn, zookeeper-fips, cassandra-reaper, kafka, apache-nifi, solr, spark-fips, cloudwatch-exporter, spark, druid, confluent-kafka-jre-bcfips, confluent-kafka, strimzi-kafka-operator, apache-tika, zookeeper...

GHSA-G8M5-722R-8WHQ vulnerabilities

Vulnerabilities for packages: solr, confluent-kafka, cloudwatch-exporter, druid, strimzi-kafka-operator, apache-nifi, zookeeper, cassandra-reaper...

CVE-2024-8184 vulnerabilities

Vulnerabilities for packages: solr, confluent-kafka, cloudwatch-exporter, druid, strimzi-kafka-operator, apache-nifi, zookeeper, cassandra-reaper...

CVE-2024-8184 vulnerabilities

Vulnerabilities for packages: celeborn, zookeeper-fips, cassandra-reaper, kafka, apache-nifi, solr, spark-fips, cloudwatch-exporter, spark, druid, confluent-kafka-jre-bcfips, confluent-kafka, strimzi-kafka-operator, apache-tika, zookeeper...

Token Leakage

sagemakertrainin is vulnerable to Token Leakage. The vulnerability is due to the logging of CodeArtifact authorization tokens in log files, which, when pushed to CloudWatch Log streams, It can allow unauthorized access to CodeArtifact resources...

AWS SageMaker Training Toolkit logs CodeArtifact Authorization token

Description For SageMaker Training Toolkit1 versions 4.7.4; 4.7.3; 4.7.2; 4.7.1; 4.7.0, the authorization tokens for CodeArtifact temporary token with an expiration of 12 hours were logged in the log files when the CodeArtifact capability was enabled. If customers push these log files to their...

GHSA-635V-PC42-FR74 AWS SageMaker Training Toolkit logs CodeArtifact Authorization token

Description For SageMaker Training Toolkit1 versions 4.7.4; 4.7.3; 4.7.2; 4.7.1; 4.7.0, the authorization tokens for CodeArtifact temporary token with an expiration of 12 hours were logged in the log files when the CodeArtifact capability was enabled. If customers push these log files to their...

PT-2024-40110 · Amazon · Cloudwatch +2

Name of the Vulnerable Software and Affected Versions: SageMaker Training Toolkit versions 4.7.0 through 4.7.4 Description: The issue concerns the logging of authorization tokens for CodeArtifact in log files when the CodeArtifact capability is enabled. These tokens have an expiration of 12 hours...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2630)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300044.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2630 advisory. Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

OpenTelemetry Collector < 0.108.0 Authentication Bypass

The OpenTelemetry Collector running on the remote host is prior to 0.108.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

Important: amazon-cloudwatch-agent

Issue Overview: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows...