Cross site request forgery (csrf)

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

CVE-2023-34085

CVE-2023-34085 describes a vulnerability where, if an AWS DynamoDB table is used for storing user attributes, an attacker can craft a request to retrieve another user’s attributes. The connected records corroborate this label and tie the issue to Ping Identity PingFederate and related disclosures...

CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...

Ping Identity PingFederate Security Vulnerability

Ping Identity PingFederate is a flagship software-based federation server in the United States. for identity management. Ping Identity PingFederate has a security vulnerability that stems from the ability to retrieve other users' attributes using maliciously crafted requests when AWS DynamoDB...

Scylla Security Breach

Scylla is a ScyllaDB open source real-time big data database compatible with Apache Cassandra and Amazon DynamoDB APIs. Scylla has a security vulnerability that stems from allowing an attacker with CREATE access to elevate to higher privileges...

MAL-2023-1245 Malicious code in nequi-aws-dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86e69f8ab2fe8a36bf3ee2e573ff2b19bb88d7dc072bd33275d8b8194b9b06dc The OpenSSF Package Analysis project identified 'nequi-aws-dynamodb' @ 1.3.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in nequi-aws-dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86e69f8ab2fe8a36bf3ee2e573ff2b19bb88d7dc072bd33275d8b8194b9b06dc The OpenSSF Package Analysis project identified 'nequi-aws-dynamodb' @ 1.3.1 npm as malicious. It is considered malicious because: - The package...

com.github.j5ik2o:akka-persistence-dynamodb-kafka-write-adaptor_2.11 (=1.1.0), com.github.j5ik2o:akka-persistence-kafka_2.11 (>=1.0.4 <=1.0.5) +1 more potentially affected by CVE-2023-29471 via com.typesafe.akka:akka-stream-kafka_2.11 (>=2.0.0 <=2.0.7)

com.typesafe.akka:akka-stream-kafka2.11 MAVEN version =2.0.0, =1.0.4, =2.0.0, =2.0.7 Source cves: CVE-2023-29471 Source advisory: OSV:GHSA-55VQ-XPJF-R2XC...

Privilege escalation in Strongbox

Impact An attacker with read-only access to a Strongbox secret could craft a valid encrypted secret same id/version. It also makes the audit logs from KMS less useful. The issue is caused by a bug in the underlying AWS Encryption SDK. By default, the encrypted secrets are stored in DynamoDB and a...

GHSA-MHGM-52VG-PVVC Privilege escalation in Strongbox

Impact An attacker with read-only access to a Strongbox secret could craft a valid encrypted secret same id/version. It also makes the audit logs from KMS less useful. The issue is caused by a bug in the underlying AWS Encryption SDK. By default, the encrypted secrets are stored in DynamoDB and a...

CVE-2022-29240 Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla

Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of...

Malicious Package

Overview amplify-category-api-dynamodb-simulator is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...

Malicious code in amplify-category-api-dynamodb-simulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8891bc9b89c5f04d865d23a8aaaa496f59bde6cca82becce21df120ddd894b9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-976 Malicious code in amplify-category-api-dynamodb-simulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8891bc9b89c5f04d865d23a8aaaa496f59bde6cca82becce21df120ddd894b9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@nexus-switchboard/nexus-conn-jira (>=0.1.0 <=0.2.2), @nexus-switchboard/nexus-mod-service (>=0.4.1 <=0.6.3) +1 more potentially affected by CVE-2021-26073 via atlassian-connect-express (>=3.5.2 <=4.4.1)

atlassian-connect-express NPM version =3.5.2, =0.1.0, =0.4.1, =0.0.1, =2.0.5 Source cves: CVE-2021-26073 Source advisory: OSV:GHSA-4V96-M8XV-X83V...

com.amazon.emr:emr-dynamodb-hadoop (>=4.2.0 <=4.3.0), com.amazon.emr:emr-dynamodb-tools (=4.2.0) +150 more potentially affected by CVE-2016-3086 via org.apache.hadoop:hadoop-yarn-server-nodemanager (>=2.7.0 <=2.7.2)

org.apache.hadoop:hadoop-yarn-server-nodemanager MAVEN version =2.7.0, =4.2.0, =1.0.4, =1.0.4, =1.2.0, =1.0.2, =1.0.2, =1.2.1, =10.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =1.2.0 - com.intropro.prairie:hbase-unit =1.2.0 and more Source cves: CVE-2016-3086 Source advisory: OSV:GHSA-895M-WW55-5...

Denial Of Service (DoS)

@soketi/soketi is vulnerable to denial of service. The vulnerability that exists in the server function in server,ts file does not properly handle the endpoint value in dynamodb allowing an attacker to crash the application...

SyntheticSun - A Defense-In-Depth Security Automation And Monitoring Framework Which Utilizes Threat Intelligence, Machine Learning, Managed AWS Security Services And, Serverless Technologies To Continuously Prevent, Detect And Respond To Threats

SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats. You sleep in fragmented glass With reflections o...

InsightCloudSec Supports 12 New AWS Services Announced at re:Invent

In case you didn’t hear, Amazon hosted AWS re:Invent in Las Vegas last week. As has come to be expected at the annual mega-event, Amazon made a number of huge announcements and launched a significant number of improvements and brand-new services and settings to enhance their public cloud platform...