CVE-2016-8520

CVE-2016-8520 affects HPE Helion Eucalyptus (v4.3.0 and earlier). The root cause is improper IAM permission checks when accessing versioned S3 objects and ACLs, enabling in some cases authenticated users with S3 permissions to access versioned data. The NVD entry documents a network-vector, low c...

CVE-2016-8520: Undefined Security Weakness

HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...

PT-2018-5014

Name of the Vulnerable Software and Affected Versions HPE Helion Eucalyptus versions 4.3.0 and earlier Description The issue arises from incorrect permission checks for IAM users accessing versioned objects and ACLs. As a result, authenticated users with S3 permissions may also be able to access...

PT-2017-14579

Name of the Vulnerable Software and Affected Versions Ceph versions 12.1.0 through 12.2.1 Description The issue allows remote authenticated users with "full" privileges to cause a denial of service by posting an invalid profile to the admin API. This is related to files rgw/rgw iam policy.cc,...

CVE-2017-16818

RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service assertion failure and application exit by leveraging "full" not necessarily admin privileges to post an invalid profile to the admin API, related to rgw/rgwiampolicy.cc, rgw/rgwbasictypes.h,...

Amazon Macie and Deep Security

Amazon S3 stores trillions of objects and regularly peaks at millions of requests per second. By any metric, it’s massive. With unparalleled durability and availability, it’s the backbone of AWS’ data services. This morning at the AWS Summit in New York City, AWS launched a new service: Amazon...

iam.3ds.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-266525 Description| Value ---|--- Affected Website:| iam.3ds.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Fedora 26 : cloud-init (2017-83671c0fa0)

This update fixes several issues with systemd service ordering and network configuration. It also backports a fix for a security issue in which instances run in EC2 write IAM instance profile credentials to disk. To work around the security issue without updating cloud-init, wait at least six hou...

AWS CIS Benchmark Tool: Prowler

Tool based on AWS-CLI commands for AWS account hardening, following guidelines of the CIS Amazon Web Services Foundations Benchmark 1.1 . It covers hardening and security best practices for all regions related to: Identity and Access Management 24 checks Logging 8 checks Monitoring 15 checks...

Soffid IAM console arbitrary code execution vulnerability

Soffid IAM console is a distributed Identity Manager console program that supports SQL-based and file-based authentication for both web and natively-based applications. A security vulnerability exists in Soffid IAM console version 1.7.4 and earlier. A remote attacker can exploit the vulnerability...

Zeus - AWS EC2 / S3 Auditing & Hardening Tool

Zeus is a powerful tool for AWS EC2 / S3 best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access Management Avoid the use of the "roo...

AWS Auditing & Hardening Tool: Zeus

Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access...

Cross site request forgery (csrf)

Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request...

CVE-2017-9363

Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request...

CVE-2017-9363

Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request...

CVE-2017-9363

Soffid IAM console before version 1.7.5 is affected by an unauthenticated remote code execution vulnerability due to untrusted Java serialization in the authentication request. Exploitation allows a remote attacker to execute arbitrary code on the server by sending a crafted authentication reques...

CVE-2017-9363

Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request...

CVE-2017-9363

Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request...

CVE-2017-9363: Deserialization of Untrusted Data

Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request...

PT-2017-18874

Name of the Vulnerable Software and Affected Versions Soffid IAM console versions prior to 1.7.5 Description The issue concerns untrusted Java serialization in the Soffid IAM console, allowing remote attackers to achieve arbitrary remote code execution via a crafted authentication request...