Malicious code in Be.Vlaandеren.Basisrеgisters.NisCodeService.DynamoDb (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4172 Malicious code in Be.Vlaandеren.Basisrеgisters.NisCodeService.DynamoDb (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Improper Signature Validation

aws-database-encryption-sdk-dynamodb is vulnerable to Improper Signature Validation. The vulnerability occurs when a Set type is assigned a SIGNONLY attribute action. In such cases, there is a chance that the signature validation of the record containing a Set may fail during read, even if the Se...

Signing DynamoDB Sets when using the AWS Database Encryption SDK.

Impact This advisory addresses an issue when a DynamoDB Set attribute is marked as SIGNONLY in the AWS Database Encryption SDK DB-ESDK for DynamoDB. This also includes when a Set is part of a List or a Map. DB-ESDK for DynamoDB supports SIGNONLY and ENCRYPTANDSIGN attribute actions. In version...

GHSA-72FP-W44G-625Q Signing DynamoDB Sets when using the AWS Database Encryption SDK.

Impact This advisory addresses an issue when a DynamoDB Set attribute is marked as SIGNONLY in the AWS Database Encryption SDK DB-ESDK for DynamoDB. This also includes when a Set is part of a List or a Map. DB-ESDK for DynamoDB supports SIGNONLY and ENCRYPTANDSIGN attribute actions. In version...

PT-2023-32985 · Amazon · Aws Database Encryption Sdk (Db-Esdk) For Dynamodb

Name of the Vulnerable Software and Affected Versions: AWS Database Encryption SDK DB-ESDK for DynamoDB versions 3.1.0 and below Description: The issue arises when a DynamoDB Set attribute is marked as SIGN ONLY in the AWS Database Encryption SDK DB-ESDK for DynamoDB, including when a Set is part...

CVE-2023-34085

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

Cross site request forgery (csrf)

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085

CVE-2023-34085 describes a vulnerability where, if an AWS DynamoDB table is used for storing user attributes, an attacker can craft a request to retrieve another user’s attributes. The connected records corroborate this label and tie the issue to Ping Identity PingFederate and related disclosures...

CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085: Exposure of Private Personal Information to an Unauthorized Actor

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

Ping Identity PingFederate Security Vulnerability

Ping Identity PingFederate is a flagship software-based federation server in the United States. for identity management. Ping Identity PingFederate has a security vulnerability that stems from the ability to retrieve other users' attributes using maliciously crafted requests when AWS DynamoDB...

Scylla Security Breach

Scylla is a ScyllaDB open source real-time big data database compatible with Apache Cassandra and Amazon DynamoDB APIs. Scylla has a security vulnerability that stems from allowing an attacker with CREATE access to elevate to higher privileges...

MAL-2023-1245 Malicious code in nequi-aws-dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86e69f8ab2fe8a36bf3ee2e573ff2b19bb88d7dc072bd33275d8b8194b9b06dc The OpenSSF Package Analysis project identified 'nequi-aws-dynamodb' @ 1.3.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in nequi-aws-dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86e69f8ab2fe8a36bf3ee2e573ff2b19bb88d7dc072bd33275d8b8194b9b06dc The OpenSSF Package Analysis project identified 'nequi-aws-dynamodb' @ 1.3.1 npm as malicious. It is considered malicious because: - The package...

Privilege escalation in Strongbox

Impact An attacker with read-only access to a Strongbox secret could craft a valid encrypted secret same id/version. It also makes the audit logs from KMS less useful. The issue is caused by a bug in the underlying AWS Encryption SDK. By default, the encrypted secrets are stored in DynamoDB and a...

GHSA-MHGM-52VG-PVVC Privilege escalation in Strongbox

Impact An attacker with read-only access to a Strongbox secret could craft a valid encrypted secret same id/version. It also makes the audit logs from KMS less useful. The issue is caused by a bug in the underlying AWS Encryption SDK. By default, the encrypted secrets are stored in DynamoDB and a...

CVE-2022-29240 Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla

Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of...