Technology
Public cloud services and their SDKs/agents (AWS, Azure, Google Cloud). 1,417 published CVES affecting Cloud Platforms, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first · page 40 of 40 · showing the latest 1,000
-= Per source details. Do not edit below this line.=- Source: google-open-source-security (96d7eea455989a7a10bf2fafd9f9c4a2d5d9a4c2a3ec852e424885f3e51c5edb) Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidd...
-= Per source details. Do not edit below this line.=- Source: google-open-source-security (456242a426a17eeaca869a5f00ee2f02d837dec5bba7da9240b6bec77c0ae8a8) Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidd...
-= Per source details. Do not edit below this line.=- Source: google-open-source-security (d804868504b96ba968b7eae99df63e235a0eaa2eab4a7951ae02c98c614f1828) Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidd...
Azure Identity SDK Remote Code Execution Vulnerability
Azure Identity SDK Remote Code Execution Vulnerability
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file
Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary co...
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
-= Per source details. Do not edit below this line.=- Source: checkmarx (2f513e1bd0172cda035284efad9368870bc46158926c112ccd7fc881e6af75be) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (9308df1...
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function ret...
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability
-= Per source details. Do not edit below this line.=- Source: checkmarx (b37bd86b6f9bda9d03029c9d2fa09561b2b43cda7c3fddda1389c8e193c4a938) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (24f9ca3...
-= Per source details. Do not edit below this line.=- Source: checkmarx (bfefcae6c29da10e63d630fc7e012995d730cc5c0af3a8144dc517f26382a3bd) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (cc5e304...
-= Per source details. Do not edit below this line.=- Source: checkmarx (644686188e6f43d2dc595074d7644cba060e6a91b8de18713f4b551a76a6c3b7) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (17af179...
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.
A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue.
A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.
-= Per source details. Do not edit below this line.=- Source: checkmarx (0c24b33d1db8fffd5daaf1985d25add4bc66e7879e1a6efbc7ae706816931834) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (54cd0ad...
-= Per source details. Do not edit below this line.=- Source: checkmarx (8af47576c10df6b4eb3fae145ce469e9ef394691bde6181e0fef25dbc8358f7a) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (9a58dbd...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.