2045 matches found
CVE-2020-2114
CVE-2020-2114 affects the Jenkins S3 Publisher Plugin (versions ≤ 0.11.4). The plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, exposing secrets to the browser environment and potentially to extensions or scripts. The root cause is the creden...
PT-2020-15321 · Jenkins · Jenkins S3 Publisher Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins S3 publisher Plugin versions 0.11.4 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure. This...
Unable to Create Folder (name: ) Error
Challenge The following error occurs when creating a folder in the S3-Compatible Object Storage bucket: "Unable to create folder name: ". Cause Certain S3-compatible API do not support an unsigned payload used by Veeam Backup for Microsoft 365 as the x-amz-content-sha256 authorization header...
Takeover v0.2 - Sub-Domain TakeOver Vulnerability Scanner
Sub-domain takeover vulnerability occur when a sub-domain subdomain.example.com is pointing to a service e.g: GitHub , AWS/S3 ,.. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that sub-domain. For example, if...
Invalid Character in Amazon S3 Bucket Name
Challenge When adding/editing an object storage repository and selecting or creating a folder in the Amazon S3 bucket, the following error occurs: Could not establish trust relationship for the SSL/TLS secure channel. Applicable to build 4.0.0.1553. Exception of type...
Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service
When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...
Dufflebag - Search Exposed EBS Volumes For Secrets
Dufflebag is a tool that searches through public Elastic Block Storage EBS snapshots for secrets that may have been accidentally left in. You may be surprised by all the passwords and secrets just laying around! The tool is organized as an Elastic Beanstalk "EB", not to be confused with EBS...
chhyun-utils (>=1.0.12, <=1.0.39), jotunheimr (>=1.11.0, <=1.12.1) +4 more potentially affected by CVE-2019-10788 via im-metadata (>=2.1.1, <=3.0.1)
im-metadata NPM version =2.1.1, =1.0.12, =1.11.0, =1.0.0-rc.1, =0.0.1, =2.0.2, =2.0.3 - wn-s3-uploader 1.0.0 Source cves: CVE-2019-10788 Source advisory: SNYK:JS-IMMETADATA-544184...
chhyun-utils (>=1.0.12, <=1.0.39), jotunheimr (>=1.11.0, <=1.12.1) +4 more potentially affected by CVE-2019-10787 via im-resize (>=2.0.2, <=2.3.2)
im-resize NPM version =2.0.2, =1.0.12, =1.11.0, =1.0.0-rc.1, =0.0.1, =2.0.2, =2.0.3 - wn-s3-uploader 1.0.0 Source cves: CVE-2019-10787 Source advisory: SNYK:JS-IMRESIZE-544183...
Scale-out Backup Repository offload job to Quantum DXI used as S3 storage fails with "Failed to retrieve SSL certificate. Underlying error: PRNG not seeded" error
Challenge Veeam Backup & Replication fails to perform an S3 offload task if targeted to Quantum DXI storage. The error retrieved in UI says: "Failed to retrieve SSL certificate. Underlying error: PRNG not seeded" 06.01.2020 13:38:21 Info PublicCloudCertificateLoader Loading certificate for...
This Week in Security News: Over 2,000 WordPress Accounts Compromised and Facebook to Pay $550M to Settle Class Action Case Over Facial Recognition
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, over two thousand WordPress sites were compromised using a malicious script that redirects visitors to scam websites. Also, read about how...
Automating API Security in the Cloud
These days, the most common way for services to communicate and transfer data is by using APIs. However, broken, exposed, or hacked APIs are the cause of some of the latest major data breaches, as they have the potential to expose sensitive data for public consumption. Securing your APIs is...
Lyst: Subdomain takeover of storybook.lystit.com
Summary: The subdomain storybook.lystit.com had an CNAME record pointing to an unclaimed S3 bucket. This is a high severity security issue because an attacker can register the bucket on AWS and therefore can serve her own content on the subdomain. This allows for various attacks. Description: The...
Ruby: Source code disclosed via S3 Bucket
Summary The Ruby having an Amazon S3 bucked named http://rubyci.s3.amazonaws.com/ which lists some of their log files. Those logs having some informations to check the source code server side directories. Steps to Reproduce 1. direct to http://rubyci.s3.amazonaws.com/ which having READ Permission...
Product release: Virtuozzo Infrastructure Platform 3.5
In this release, Virtuozzo Infrastructure Platform offers a wide range of new features that enhance the experience of users working with compute virtualization and software-defined networking functionalities. Additionally, the update delivers stability improvements and addresses bugs found in...
prd-medweb-cdn.s3.amazonaws.com Improper Access Control vulnerability
Security Researcher NotAkay Helped patch 1 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting prd-medweb-cdn.s3.amazonaws.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard...
How we Developed a Unified Binary Store (UBS): Part 1
Like most technology companies, VMware Carbon Black has a combination of acquired and built technologies that all utilize their own data stores. As our products have evolved to include the benefits of a centralized cloud offering, our data stores needed to similarly evolve. A new goal was formed:...
Razer: Aws bucket writable mobile.razer.com
The tester discovered an S3 bucked owned by Mobile that was writeable. No files were present but the permissions were incorrect and subsequently fixed. Razer appreciates the report...
