68 matches found
turbolite
turbolite turbolite 是一个用 Rust 实现的 SQLite VFS，能够直接从 S3 提供点查询和连接，冷启动延迟低于 250 毫秒。 本仓库是一个 Cargo 工作空间，包含两个 crate： turbolite — 纯 Rust 库。提供页面级压缩、加密和 S3 分层的 SQLite VFS。 turbolite-ffi — C FFI / 可加载扩展 + 语言绑定（Python、Node.js、Go）。 它还提供页面级压缩（zstd）和加密（AES-256），以实现静止状态下的效率和安全性，这些功能可以独立于 S3 使用。 实验性。 turbolite...
karton
Karton 基于Python、Redis和S3的分布式恶意软件处理框架。 理念 Karton 是一个稳健的框架，用于创建灵活 且轻量级 的恶意软件分析后端。它可以用于将恶意软件分析系统连接成一个稳健的流水线，几乎无需繁琐操作。 我们在自动化领域已经深耕多年。面对越来越多的威胁，我们不得不将所有工作自动化以跟上事件响应的节奏。正因为如此，我们经常最终得到许多用胶带 和WD-40拼凑在一起的脚本。这些脚本是分析师在紧急时刻编写的，脆弱且丑陋——但它们能工作，能产生必须存储、进一步处理、发送到其他系统或与其他组织共享的情报。...
nuclearpond-OFJAAAH
Nuclear Pond V.2 Hicimos un fork de este proyecto para poder continuar con esta gran idea, espero que juntos podamos mejorar el código y hacerlo disponible para todos - @OFJAAAH Para instalar Nuclear Pond, necesitas configurar el backend módulo de terraform. Puedes hacerlo ejecutando terraform...
nuclearpond
Nuclear Pond Nuclear Pond se utiliza para aprovechar Nuclei en la nube con velocidad, flexibilidad notables, y realizar escaneos a nivel de Internet por mucho menos que el costo de un café. Aprovecha AWS Lambda como backend para invocar escaneos de Nuclei en paralelo, con la opción de almacenar...
amira
AMIRA：自动化恶意软件事件响应与分析 AMIRA 是一种服务，用于自动对 OSXCollector 输出文件进行分析。自动化分析通过 OSXCollector Output Filters 执行，特别是《统御一切的过滤器》：Analyze Filter。AMIRA 负责从 S3 存储桶中检索输出文件，运行 Analyze Filter，然后将分析结果上传回 S3（当然，也可以设想将结果附加到相关的 JIRA 工单上）。 前提条件 tox 以下步骤假设您的机器上已安装 tox。 如果尚未安装，请运行： root@kitploit: $ sudo pip install tox...
CVE-2026-90614
FedML-AI FedML versions up to 0.9.6 contain a deserialization vulnerability in the MQTT+S3 Communication Backend component. The flaw resides in the S3Storage.read_model function within fedml/core/distributed/communication/s3/remote_storage.py, where manipulation of the s3_key_str argument trigger...
CVE-2026-90614 FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization
A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...
Security Bulletin: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
Summary Langflow uses a local and S3-backed storage service to manage files uploaded by users and referenced by flow components. The flow execution runtime accepts attacker-controlled file paths through the tweaks API without invoking the path containment guard, allowing traversal sequences to...
CVE-2026-48035 Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...
Malicious Package
Overview @cloudplatform-single-spa/svp-s3-storage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the UploadAllFiles function during S3 restore operations when processing tar headers from a supplied backup archive. An attacker can cause the daemon to crash and disrupt the contr...
CVE-2026-28377
A flaw was found in Grafana Tempo. This vulnerability exposes the S3 Server-Side Encryption with Customer-Provided Keys SSE-C encryption key in plaintext through the /status/config endpoint. A remote attacker could exploit this to obtain the key, potentially allowing unauthorized access and...
CVE-2026-28377
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to williamgoodfellow for reporting this vulnerability...
Unspecified Vulnerability in StudioCMS (CNVD-2026-18150)
StudioCMS is StudioCMS open source a content management system . A security vulnerability exists in StudioCMS that can be exploited by an attacker to cause an authenticated user to perform arbitrary file operations on S3 storage buckets...
GHSA-MM78-FGQ8-6PGR StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Summary The S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorizedtype always evaluates to false, completely bypassing the authorization check...
CVE-2026-32101 StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...
CVE-2026-32101
CVE-2026-32101 affects StudioCMS S3 Storage Manager prior to version 0.3.1. The isAuthorized() function is async but is called without await in both the POST and PUT handlers, causing the authorization check to always evaluate to bypass due to Promise objects being truthy. As a result, any authen...
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
Summary S3 Encryption Client for PHP is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders...
