CVE-2020-2188

A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2020-2188

Summary (CVE-2020-2188) : The Jenkins Amazon EC2 Plugin (versions 1.50.1 and earlier) contains a missing permission check in form-related methods that allows any user with Overall/Read access to enumerate credentials IDs stored in Jenkins. This exposure can aid an attacker who already has basic a...

CVE-2020-2186

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances...

CVE-2020-2185

CVE-2020-2185 – Jenkins Amazon EC2 Plugin : Affects Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier. The issue is a lack of SSH host key validation when connecting agents, enabling potential man‑in‑the‑middle attacks. The connected Red Hat, OSV, GHSA, CNVD, and other entries corroborate the...

CVE-2020-2186

CVE-2020-2186 describes a CSRF vulnerability in the Jenkins Amazon EC2 Plugin ≤ 1.50.1, where several HTTP endpoints did not require POST, allowing an attacker to provision EC2 instances with attacker‑supplied templates. The root cause is insufficient CSRF protection on those endpoints, enabling ...

CVE-2020-2185

Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks...

CVE-2020-2186: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances...

CVE-2020-2185: Undefined Security Weakness

Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks...

CVE-2020-12692: Authentication Bypass by Capture-replay

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

PT-2020-15402 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier Description: A missing permission check in form-related methods of the Jenkins Amazon EC2 Plugin allows users with Overall/Read access to enumerate credentials IDs of credentials stored in...

Lack of SSL/TLS certificate and hostname validation in ec2

ec2 connects to Windows agents via HTTPS. ec2 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connectio...

CVE-2020-2188: Incorrect Authorization

A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

PT-2020-13206 · Openstack +1 · Openstack Keystone +1

Name of the Vulnerable Software and Affected Versions: OpenStack Keystone versions prior to 15.0.1 OpenStack Keystone version 16.0.0 Description: An issue allows any user authenticated within a limited scope to create an EC2 credential with escalated permission, such as obtaining admin while the...

PT-2020-15400 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier Description: A cross-site request forgery issue allows attackers to provision instances. The vulnerability is due to the plugin not requiring POST requests in several HTTP endpoints,...

CVE-2020-12689: Improper Privilege Management

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope trust/oauth/application credential can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially...

CVE-2020-2187: Improper Certificate Validation

Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks...

CVE-2020-12691: Incorrect Authorization

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user...

"Value cannot be null. Parameter name: dnsName” Error when performing Infrastructure scans in Veeam Backup for AWS

For more information about Veeam Plug-In for AWS considerations and limitations, please review: Veeam Backup for AWS User Guide Planning and Preparation Considerations and Limitations Challenge When performing an infrastructure scan in Veeam Backup for AWS, you receive the following error: " Fail...

The AWS Service to Focus On – Amazon EC2

If we run a contest for Mr. Popular of Amazon Web Services AWS, without a doubt Amazon Simple Storage Service S3 has ‘winner’ written all over it. However, what’s popular is not always what is critical for your business to focus on. There is popularity and then there is dependability. Let’s...

ec2-18-139-53-85.ap-southeast-1.compute.amazonaws.com Cross Site Scripting vulnerability

Security Researcher thakurbivesh Helped patch 53 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting ec2-18-139-53-85.ap-southeast-1.compute.amazonaws.com website and its users...