CVE-2012-5781: Improper Input Validation

Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to...

How Facebook and Facial Recognition Are Creating a Minority Report-Style Privacy Meltdown

Researchers at the annual Black Hat Briefings in Las Vegas have demonstrated how cloud computing, facial recognition technology, Facebook, a freely available personal information can be used to match faces in a crowd to detailed online profiles. The demonstration brings us closer to the brink of ...

USN-1137-1: Eucalyptus vulnerability

Juraj Somorovsky, Jorg Schwenk, Meiko Jensen and Xiaofeng Lou discovered that Eucalyptus did not properly validate SOAP requests. An unauthenticated remote attacker could exploit this to submit arbitrary commands to the Eucalyptus SOAP interface in the context of an authenticated user...

Amazon Web Service Down, No Timeline for Remedy

Amazon Web Service’s AWS Elastic Compute Cloud EC2, based in Northern Virginia, went offline early this morning, taking with it a number of popular sites including, news aggregator Reddit and question and answer site and TechCrunch darling, Quora.The Web hosting firm’s Relational Database Service...

Amazon Moves to Mitigate Threats to Cloud Service

Amazon said today that it has taken steps to mitigate a security issue in its cloud computing infrastructure that was identified recently by researchers from MIT and the University of California at San Diego. The report described how attackers could search for, locate and attack specific targets ...

Arbitrary file deletion

Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/enomalism2.pid temporary file...

CVE-2009-0390

Argument injection vulnerability in Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program...

CVE-2008-4990

Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/enomalism2.pid temporary file...

CVE-2009-0390

Argument injection vulnerability in Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program...

CVE-2008-4990

Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/enomalism2.pid temporary file...

CVE-2009-0390

CVE-2009-0390 concerns Enomaly ECP/Enomalism (pre-2.2.1) with local vulnerabilities in enomalism2.sh, where insecure temporary file handling enables argument injection into kill and signaling of arbitrary processes via the /tmp/enomalism2.pid PIDFILE. Connected sources describe a race condition o...

CVE-2008-4990: Improper Link Resolution Before File Access

Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/enomalism2.pid temporary file...

CVE-2009-0390: Improper Control of Generation of Code

Argument injection vulnerability in Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program...

Directory traversal

Multiple directory traversal vulnerabilities in Elastic Path EP 4.1 and 4.1.1 allow remote attackers to 1 download arbitrary files via a .. dot dot in the file parameter to manager/getImportFileRedirect.jsp, 2 upload arbitrary files via a ".." dot dot backslash in the file parameter to...

CVE-2008-1606

This CVE describes multiple directory traversal vulnerabilities in Elastic Path (EP) versions 4.1 and 4.1.1. The issues allow: (1) downloading arbitrary files via a .. path in the file parameter to manager/getImportFileRedirect.jsp, (2) uploading arbitrary files via a ..\ path in the file paramet...

CVE-2008-1606

Multiple directory traversal vulnerabilities in Elastic Path EP 4.1 and 4.1.1 allow remote attackers to 1 download arbitrary files via a .. dot dot in the file parameter to manager/getImportFileRedirect.jsp, 2 upload arbitrary files via a ".." dot dot backslash in the file parameter to...

CVE-2008-1606: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Elastic Path EP 4.1 and 4.1.1 allow remote attackers to 1 download arbitrary files via a .. dot dot in the file parameter to manager/getImportFileRedirect.jsp, 2 upload arbitrary files via a ".." dot dot backslash in the file parameter to...

Elastic Path 4.1 - managergetImportFileRedirect.jsp?file Traversal Arbitrary File Access

Elastic Path 4.1 - managergetImportFileRedirect.jsp?file Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/28352/info Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include: - A loc...

Elastic Path 4.1 - '/manager/getImportFileRedirect.jsp?file' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/28352/info Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include: - A local file-include vulnerability. - An arbitrary file-upload vulnerability. - A...

Elastic Path 4.1 - managerFileManager.jsp?dir Traversal Arbitrary Directory Listing

Elastic Path 4.1 - managerFileManager.jsp?dir Traversal Arbitrary Directory Listing source: https://www.securityfocus.com/bid/28352/info Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include: - A local...