Automox Alive Automox Agent Access Control Error Vulnerability

Automox Alive Automox Agent is an application from the Automox Alive community. An agent software. An Access Control Error vulnerability exists in versions prior to Automox Agent 31 that stems from the use of inadequately protected S3 bucket endpoints to store sensitive files, which can be...

U.S. Dept Of Defense: S3 bucket listing/download

It's possible to get a listing and download every file in the S3 bucket ██████████ and ███████ . Supporting Material/References https://hackerone.com/reports/278191 Impact An attacker can download files that are not intended to be public, both buckets are very big. An attacker can increase...

CVE-2021-26909

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

Code injection

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

CVE-2021-26909

CVE-2021-26909 affects the Automox Agent prior to version 31. The root cause is an insufficiently protected S3 bucket endpoint used to store sensitive files, which could be brute-forced by an attacker to subvert an organization’s security program. Mitigation: upgrade to Automox Agent 31 or later,...

CVE-2021-26909 Automox Agent Guessable S3 Bucket Endpoint

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

CVE-2021-0253 Junos OS: NFX Series: Local Command Execution Vulnerability in JDMD Leads to Privilege Escalation

NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby allowing an attacker to elevate their privileges via the Junos Device Management Daemon JDMD process. This issue affects Juniper Networks Junos OS on NFX Series 17.2 version 17.2R...

CVE-2021-0243 Junos OS: EX4300: Stateless firewall policer fails to discard traffic

Improper Handling of Unexpected Data in the firewall policer of Juniper Networks Junos OS on EX4300 switches allows matching traffic to exceed set policer limits, possibly leading to a limited Denial of Service DoS condition. When the firewall policer discard action fails on a Layer 2 port, it wi...

How to scan and encrypt objects in S3 buckets

This article explains how to scan objects in S3 buckets against malware and keep your objects encrypted with SSE-KMS...

SUSE: Security Advisory (SUSE-SU-2015:0353-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Juniper Junos OS Vulnerability (JSA11129)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11129 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable Network Security, Inc...

Granular AWS Account Permissions for Adding an S3 Repository

This article documents the granular permissions required to add an S3 repository to Veeam Backup for AWS...

chhyun-utils (>=1.0.12, <=1.0.39), s3-uploader (>=2.0.0-rc.1, <=2.0.3) +3 more potentially affected by CVE-2019-10788 via im-metadata (3.0.1)

im-metadata NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on im-metadata and may be impacted: - chhyun-utils =1.0.12, =2.0.0-rc.1, =0.0.1, =2.0.2, =2.0.3 - wn-s3-uploader 1.0.0 Source cves: CVE-2019-10788 Source advisory:...

chhyun-utils (>=1.0.12, <=1.0.39), jotunheimr (>=1.11.0, <=1.12.1) +4 more potentially affected by CVE-2019-10787 via im-resize (>=2.0.2, <=2.3.2)

im-resize NPM version =2.0.2, =1.0.12, =1.11.0, =1.0.0-rc.1, =0.0.1, =2.0.2, =2.0.3 - wn-s3-uploader 1.0.0 Source cves: CVE-2019-10787 Source advisory: OSV:GHSA-R9VM-RHMF-7HXX...

OESA-2021-1145 rubygem-rails security update

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration. Security Fixes: A deserialization of untrusted data vulnernerability exists in rails 5.2.4.3, rails 6.0.3.1 that can...

Man-in-the-middle (MITM)

github.com/minio/minio is vulnerable to man-in-the-middle attack. The vulnerability exists because it does not properly read and verify S3 signature v4 chunks separately, allowing modification of request bodies that are meant to have integrity guaranteed by chunk signatures...

CVE-2021-21390

MinIO (open-source object storage) contains a PUT-mode vulnerability in aws-chunked encoding where the server may skip end-of-chunk signature verification if a forged chunk size is sent, enabling MITM modification of request bodies intended to be protected by chunk signatures. This affects releas...

CVE-2021-21390

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guarante...

Sensitive data from US shipping management software firm exposed online

By Habiba Rashid In total, 103 GB worth of data belonging to New Jersy based Descartes Aljex Software was left exposed on a misconfigured AWS S3 Bucket. This is a post from HackRead.com Read the original post: Sensitive data from US shipping management software firm exposed online...

COVID-19 testing service in US exposes patients’ photos, passports

By Habiba Rashid COVID-19 testing service in the State of Utah stored passport scans and other highly personal data on unsecured Amazon S3 buckets. This is a post from HackRead.com Read the original post: COVID-19 testing service in US exposes patients photos, passports...