Technology
Public cloud services and their SDKs/agents (AWS, Azure, Google Cloud). 1,417 published CVES affecting Cloud Platforms, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first · page 28 of 40 · showing the latest 1,000
-= Per source details. Do not edit below this line.=- Source: kam193 (6ce39a0e7a45f8d70e0e7e0d0e597b5029dcfcdd422ec0fec324921c5021a9ca) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
-= Per source details. Do not edit below this line.=- Source: kam193 (d7e3b4390ccf704149d75e6c01eb4303d21c263875186c930181e0aa7ca6495b) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tasks service leaks an Intune service access token to the system journal. This short-lived token can be used to detect the h...
-= Per source details. Do not edit below this line.=-
RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This cou...
-= Per source details. Do not edit below this line.=- Source: kam193 (6058bfefce274f953708b9c8ba745b15525a3f573da10dac8597285eac526fd4) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the conf...
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberArk believes there to be very few installat...
Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.5 and 13.6 are vulnerable to bypass of the IAM authenticator. An attack...
Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it.
Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network.
Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally.
-= Per source details. Do not edit below this line.=- Source: kam193 (b2470d0f1bf1493c176d8622368f7f975be80c5f8a2acfa1dcae8199bc54e7ed) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
-= Per source details. Do not edit below this line.=- Source: kam193 (53d3ded73c297df3a6a010b08188ed7b3fab13570e8d72492803ae3903a49939) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 [Why] If the dummy values in populate_dummy_dml_surface_cfg() aren't updated then they can lead to a divide by zero in downstream callers lik...
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check stream id dml21 wrapper to get plane_id [Why & How] Fix a false positive warning which occurs due to lack of correct checks when querying plane_id in DML21. This fixes the warning when perf...
An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve...
git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. Thi...
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user g...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.