CVE-2021-21362

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...

CVE-2021-21362

MinIO vuln CVE-2021-21362 affects MinIO before RELEASE.2021-03-04T00-53-13Z. A remote attacker could bypass a readOnly policy by creating a temporary 'mc share upload' URL, enabling modification of a resource in multi-user deployments. The issue is fixed in RELEASE.2021-03-04T00-53-13Z. Workaroun...

[SECURITY] Fedora 33 Update: ceph-15.2.9-1.fc33

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage...

CVE-2020-16144

The CVE-2020-16144 issue affects ownCloud's files_antivirus component versions before 0.15.2 when using object storage (e.g., S3) as the file store. If a user creates a public link to a folder allowing anonymous uploads and another user uploads a virus, the antivirus detects the malware but canno...

MinIO Cross-Site Request Forgery Vulnerability

Minio is an open source object storage server from US-based MinIO. The product supports building infrastructures for machine learning, analytics, and application data workloads. MinIO suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to modify calls to t...

CVE-2021-21287

MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or...

CVE-2021-21287

MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or...

CVE-2021-21287

Summary: CVE-2021-21287 affects MinIO Browser API. Before version RELEASE.2021-01-30T00-20-58Z, the server is vulnerable to a Server-Side Request Forgery (SSRF) in URL-related functionality (importing/publishing/reading from a URL). An attacker can trick the server into issuing requests to intern...

CVE-2021-21287 Server-Side Request Forgery in MinIO Browser API

MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or...

[SECURITY] Fedora 33 Update: ceph-15.2.8-1.fc33

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage...

CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

Code injection

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

CVE-2020-13359 affects GitLab CE/EE with the Terraform API in 12.10+ where the object storage signed URL is exposed on the delete operation. This allows a malicious project maintainer to overwrite the Terraform state and bypass audit/business controls. Affected versions are >=12.10, =13.4, =13...

CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

Removed by vendor...

CVE-2020-13359: Undefined Security Weakness

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

How to Create a Secure IAM Policy for Connection to S3 Object Storage

Purpose This article documents how to create a secure IAM policy to connect to the S3 bucket used as an object storage repository in Veeam Backup for Microsoft 365 for storing backup data. Solution The following permissions will allow Veeam Backup for Microsoft 365 to access the S3 bucket to save...

Product release: Virtuozzo Hybrid Infrastructure 4.0 (4.0.0-734)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance the end-user experience and service providers' interoperability. The improvements cover networking, storage core, appliance, object storage, monitoring, performance charts, and localization...