PT-2025-4003 · Amazon · Aws Sign-In Iam

Name of the Vulnerable Software and Affected Versions: AWS IAM affected versions not specified Description: The issue is related to variable response times in the AWS Sign-in IAM user login flow, which allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an...

CVE-2024-11923

Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub Formerly named Helpsystems One prior to version 1.3...

CVE-2024-11923 Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3

Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub Formerly named Helpsystems One prior to version 1.3...

CVE-2024-11923 Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3

Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub Formerly named Helpsystems One prior to version 1.3...

CVE-2024-11923

CVE-2024-11923 describes a data disclosure in Fortra Application Hub (formerly Helpsystems One) where, under certain log settings, the IAM or CORE service logs credentials in the iam logfile prior to version 1.3. Affected component: Fortra Application Hub IAM/CORE logging workflow; issue arises f...

GHSA-V4MQ-X674-FF73 AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...

AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...

CVE-2025-23206

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

AWS VDP: Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The non-production API endpoints for the ssm service were found to fail to log to CloudTrail, resulting in silent permission enumeration. Eighteen non-production endpoints were identified that can be used with standard IAM credentials without generating CloudTrail logs...

Privilege Escalation

github.com/minio/minio is vulnerable to Privilege Escalation. The vulnerability is due to improper validation and handling of imported IAM policies in the IAM import API, allows an attacker to escalate their privileges and potentially gain unauthorized access to resources or perform actions beyon...

The many ways to obtain credentials in AWS

Dive into the complexities of AWS IAM credentials and uncover how defenders can stay ahead with in-depth knowledge of SDK behaviors and service-specific mechanisms...

SUSE CVE-2024-55949

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f. This issue has been addressed in commit...

GO-2024-3336 MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio

MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio...

CVE-2024-55949

A flaw was found in MinIO. Due to insufficient permissions checking in the IAM import API, a user may be able to change their policy mapping to escalate their privileges via a specially crafted configuration file...

SUSE SLES15 / openSUSE 15 Security Update : aws-iam-authenticator (SUSE-SU-2024:4329-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4329-1 advisory. - CVE-2022-1996: Fixed CORS bypass bsc1200528. Tenable has extracted the preceding description block directly from the SUSE...

CVE-2024-55949

MinIO is affected by a privilege-escalation flaw in the IAM import API. The issue impacts all users since the commit 580d9db85e04f1b63cc2909af50f0ed08afa965f, with a fix introduced in commit f246c9053f9603e610d98439799bdd2a6b293427 and released in RELEASE.2024-12-13T22-19-12Z. There are no workar...

CVE-2024-55949 Privilege escalation in IAM import API in MinIO

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f. This issue has been addressed in commit...

CVE-2024-55949 Privilege escalation in IAM import API in MinIO

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f. This issue has been addressed in commit...

CVE-2024-55949 Privilege escalation in IAM import API in MinIO

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f. This issue has been addressed in commit...

MinIO vulnerable to privilege escalation in IAM import API

Impact Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f Patches commit f246c9053f9603e610d98439799bdd2a6b293427 Author: Aditya Manthramurthy Date: Wed Dec 11 18:09:40 2024 -0800 fix: Privilege escalation in IAM import API...