CVE-2024-10125

The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcorevalidatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer ALB OpenId Connect integration and can be used in any ASP.NET...

CVE-2024-10125 Lack of JWT issuer and signer validation

The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcorevalidatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer ALB OpenId Connect integration and can be used in any ASP.NET...

CVE-2024-10125

CVE-2024-10125 concerns the Amazon.ApplicationLoadBalancer.Identity.AspNetCore middleware used with ALB OpenID Connect in ASP.NET Core deployments. The root cause is that JWT handling performs signature validation but fails to validate the JWT issuer and signer identity, enabling a signed token f...

MAL-2024-9551 Malicious code in client-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaf50ae6ac4fef994c4e5f3095c453c17478c09407aa364dce4a46981ba9eefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in client-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaf50ae6ac4fef994c4e5f3095c453c17478c09407aa364dce4a46981ba9eefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

io.jenkins.plugins:aws-lambda-cloud (>=0.3, <=0.4), org.jenkins-ci.main:jenkins-test-harness (1.635) +2 more potentially affected by CVE-2024-47804 via org.jenkins-ci.main:jenkins-core (1.635)

org.jenkins-ci.main:jenkins-core MAVEN version 1.635 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.jenkins.plugins:aws-lambda-cloud =0.3, =0.4 - org.jenkins-ci.main:jenkins-test-harness 1.635...

io.jenkins.plugins:aws-lambda-cloud (>=0.3, <=0.4), org.jenkins-ci.main:jenkins-test-harness (1.635) +2 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.635)

org.jenkins-ci.main:jenkins-core MAVEN version 1.635 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.jenkins.plugins:aws-lambda-cloud =0.3, =0.4 - org.jenkins-ci.main:jenkins-test-harness 1.635...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-test-harness (1.599) +7 more potentially affected by CVE-2024-47804 via org.jenkins-ci.main:jenkins-core (1.599)

org.jenkins-ci.main:jenkins-core MAVEN version 1.599 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.xti.jenkins.plugins:aws-lambda-jenkins-plugin 0.0.1 -...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-test-harness (1.599) +7 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.599)

org.jenkins-ci.main:jenkins-core MAVEN version 1.599 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.xti.jenkins.plugins:aws-lambda-jenkins-plugin 0.0.1 -...

LoadZilla LoadLogic security vulnerability

LoadZilla LoadLogic is an application from LoadZilla, Inc. A security vulnerability exists in LoadZilla LoadLogic v1.4.3. An attacker can exploit the vulnerability to execute arbitrary code via the LogicLoadEc2DeployLambda and CredsGenFunction functions...

better-lambda-deploy (>=0.0.4, <=0.2.1) potentially affected by unknown CVE via aws-sam-cli (0.40.0)

aws-sam-cli PYPI version 0.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-sam-cli and may be impacted: - better-lambda-deploy =0.0.4, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-RJC6-VM4H-85CG...

better-lambda-deploy (>=0.2.2, <=0.5.9) potentially affected by unknown CVE via aws-sam-cli (0.41.0)

aws-sam-cli PYPI version 0.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-sam-cli and may be impacted: - better-lambda-deploy =0.2.2, =0.5.9 Source cves: unknown CVE Source advisory: OSV:GHSA-RJC6-VM4H-85CG...

better-lambda-deploy (>=0.6.0, <=0.6.9) potentially affected by unknown CVE via aws-sam-cli (0.53.0)

aws-sam-cli PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-sam-cli and may be impacted: - better-lambda-deploy =0.6.0, =0.6.9 Source cves: unknown CVE Source advisory: OSV:GHSA-RJC6-VM4H-85CG...

better-lambda-deploy (>=0.7.0, <=0.8.5), localambda (0.0.1) potentially affected by unknown CVE via aws-sam-cli (>=1.12.0, <=1.38.1)

aws-sam-cli PYPI version =1.12.0, =0.7.0, =0.8.5 - localambda 0.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-RJC6-VM4H-85CG...

better-lambda-deploy (>=0.7.0, <=0.8.5), localambda (0.0.1) potentially affected by unknown CVE via aws-sam-cli (>=1.12.0, <=1.38.1)

aws-sam-cli PYPI version =1.12.0, =0.7.0, =0.8.5 - localambda 0.0.1 Source cves: unknown CVE Source advisory: GHSA-RJC6-VM4H-85CG...

Attackers Exploit Public .env Files to Breach Cloud Accounts in Extortion Campaign

A large-scale extortion campaign has compromised various organizations by taking advantage of publicly accessible environment variable files .env that contain credentials associated with cloud and social media applications. "Multiple security missteps were present in the course of this campaign,...

io.jenkins.plugins:aws-lambda-cloud (>=0.3, <=0.4), org.jenkins-ci.main:jenkins-test-harness (1.635) +2 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.635)

org.jenkins-ci.main:jenkins-core MAVEN version 1.635 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.jenkins.plugins:aws-lambda-cloud =0.3, =0.4 - org.jenkins-ci.main:jenkins-test-harness 1.635...

io.jenkins.plugins:aws-lambda-cloud (>=0.3, <=0.4), org.jenkins-ci.main:jenkins-test-harness (1.635) +2 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.635)

org.jenkins-ci.main:jenkins-core MAVEN version 1.635 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.jenkins.plugins:aws-lambda-cloud =0.3, =0.4 - org.jenkins-ci.main:jenkins-test-harness 1.635...

AI/LLM Model File Contains Executable Code (Keras HFS5 .h5)

Binary data aimodelkerashfs5containsexecutablecode.nbin...

MAL-2024-7844 Malicious code in lambda-sns-dynatrace-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6846e2cf86562a1515400ba129d4fef5beb818c3002079e8bdd09c9e86f00fc5 Any computer that has this package install...