Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Nov 8, 2024A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all applicatCVE-2024-52314 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.9
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.
- Product
- data.all
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 8, 2024An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user CVE-2024-52313 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.3
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.
- Product
- data.all
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 8, 2024Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSCVE-2024-52312 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.3
Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.
- Product
- data.all
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 8, 2024Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authoriCVE-2024-52311 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.3
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.
- Product
- data.all
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 8, 2024An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their usCVE-2024-10953 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.3
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.
- Product
- data.all
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Jun 28, 2023AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services.CVE-2023-36467 · Other software · awslabs · reported by GitHubHigh 8
AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.
- Product
- aws-dataall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.