openSUSE Security Update : libmediainfo / mediainfo (openSUSE-2020-1390)

This update for libmediainfo, mediainfo fixes the following issues : libmediainfo was updated to version 20.08 : Added : - MPEG-H 3D Audio full featured support group presets, switch groups, groups, signal groups - MP4/MOV: support of more metadata locations - JSON and XML outputs: authorize...

Mail.ru: [my.games, lootdog.io] XSS via MCS Bucket

Proxy pass for the path in my.games and lootdog.io domains was misconfigured to point to the root of public S3 storage, allowing to place static content in the domain path leading to XSS possibility...

Sonatype Nexus Repository Information Disclosure Vulnerability

Sonatype Nexus Repository is a repository manager from Sonatype USA. It is mainly used for managing, storing, and distributing software, among other things. An information disclosure vulnerability exists in Nexus Repository version 3.26.1. An attacker with administrative user privileges could...

CVE-2020-8341

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers PRx. After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPa...

Security update for ldb, samba (important)

openSUSE Security Update: Security update for ldb, samba Announcement ID: openSUSE-SU-2020:1313-1 Rating: important References: 1141320 1162680 1169095 1169521 1169850 1169851 1171437 1172307 1173159 1173160 1173161 1173359 1174120 Cross-References: CVE-2020-10700 CVE-2020-10704 CVE-2020-10730...

CVE-2020-24622

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user...

CVE-2020-24622

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user...

Code injection

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user...

CVE-2020-24622

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user...

CVE-2020-24622

CVE-2020-24622 affects Sonatype Nexus Repository 3.26.1. An admin user can disclose S3 secret keys due to an information-disclosure vulnerability. The NVD entry lists CVSSv3.1 base score 4.9 (Medium) with network attack and low complexity; confidentiality impact is high while other impacts are no...

CVE-2020-8912

A flaw was found in the AWS S3 Crypto SDK where algorithm parameters for the data encryption key are not authenticated. This flaw allows attackers with S3 bucket write access to change the negotiated encryption algorithm, potentially providing viable brute force methods to recover plaintext. This...

CVE-2020-8911

A flaw was found in the AWS S3 Crypto SDK that allows users to encrypt files stored in S3 buckets with AES-CBC, without computing a MAC on the data. This allows for a padding oracle, enabling attackers with both write access to the target S3 bucket and the ability to observe the result of valid...

350 million email addresses exposed on misconfigured AWS S3 bucket

By Sudais Asif It is still unclear who owned the misconfigured Amazon S3 bucket. This is a post from HackRead.com Read the original post: 350 million email addresses exposed on misconfigured AWS S3 bucket...

DAGOBAH - Open Source Tool To Generate Internal Threat Intelligence, Inventory & Compliance Data From AWS Resources

Dagobah is an open source tool written in python to automate the internal threat intelligence generation, inventory collection and compliance check from different AWS resources. Dagobah collects information and save the state into an elasticsearch index. Dagobah runs into the a LAMBDA and looks a...

CVE-2020-8911

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...

CVE-2020-8912

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

CVE-2020-8911

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...

Authentication flaw

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

Design/Logic Flaw

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...

CVE-2020-8912 In-band key negotiation issue in AWS S3 Crypto SDK for GoLang

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...