Skip to contentAmazon vulnerabilities
Newest
- amazon redshift python connector, redshift connector +1 moreSQL Injection in the Amazon Redshift Python Connector affecting v2.1.4CVE-2024-12745Fix available8.6 High
- amazon redshift jdbc driver, web services redshift java database connectivity driver +1 moreSQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31CVE-2024-12744Fix available8.6 High
- amazon opensearch data prepper, opensearch-project data-prepper +1 moreOpenTelemetry Logs source may lack authentication with some custom pluginsCVE-2024-558866.9 Medium
- amazon data.alldata.all admin user may access potentially sensitive data stored by producers via logsCVE-2024-523146.9 Medium
- amazon data.alldata.all authenticated users can perform restricted operations against DataSets and EnvironmentsCVE-2024-523125.3 Medium
- amazon data.alldata.all authenticated users can obtain incorrect object level authorizationsCVE-2024-523135.3 Medium
- amazon data.alldata.all authenticated users can perform mutating update operations on persisted notification recordsCVE-2024-109535.3 Medium
- amazon data.alldata.all does not invalidate authentication token upon user logoutCVE-2024-523115.3 Medium
- amazon amazon.applicationloadbalancer.identity.aspnetcore middlewareLack of JWT issuer and signer validationCVE-2024-101256.9 Medium
- amazon aws alb route directive adapter for istioLack of JWT issuer and signer validationCVE-2024-89016.9 Medium
- amazon aws cloud development kit, aws aws-cdk +1 moreAWS CDK RestApi not generating authorizationScope correctly in resultant CFN templateCVE-2024-45037Fix available6.4 Medium
- openbsd openssh, almalinux, amazon linux +71 more +73 moreOpenssh: regresshion - race condition in ssh allows rce/dosCVE-2024-6387Public exploitFix availableEPSS 99.5%8.1 High
- amazon freertos-plus-tcpFreeRTOS-Plus-TCP Buffer Over-Read in DNS Response ParserCVE-2024-383739.6 Critical
- amazon aws deployment framework, awslabs aws-deployment-framework +1 moreaws-deployment-framework's potential risk can lead to privilege escalationCVE-2024-372937.6 High
- amazon aws client vpnAmazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE…CVE-2024-301657.1 High
- amazon aws amplify cli, aws amplify cli +1 moreAWS Amplify CLI has incorrect trust policy managementCVE-2024-28056Fix available9.8 Critical
- amazon freertos, freertos freertos-kernel +1 morePrivilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabledCVE-2024-281158.8 High
- amazon fire osAmazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish...CVE-2024-273505.9 Medium
- amazon ion, amazon-ion ion-java +1 moreIon Java StackOverflow vulnerabilityCVE-2024-21634Fix available7.5 High
- amazon awslabs sandbox accounts for events, awslabs sandbox-accounts-for-events +1 moreSandbox Accounts for Events vulnerable to privilege escalation to read running events dataCVE-2023-513867.8 High
- awslabs sandbox-accounts-for-events, amazon awslabs sandbox accounts for events +1 moresandbox-accounts-for-events security misconfiguration leads to budget exceedCVE-2023-509287.1 High
- amazon aws software development kit, aws aws-sdk-php +1 morePotential URI resolution path traversal in the AWS SDK for PHPCVE-2023-51651Fix available6.0 Medium
- amazon freertos, texas instruments cc32xx, simplelink msp432e4xx +8 more +10 moreTexas Instruments FREERTOS Integer Overflow or WraparoundCVE-2021-275047.4 High
- amazon opensearch, embysupport security +1 moreOpenSearch Issue with tenant read-only permissionsCVE-2023-45807Fix available5.4 Medium
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- amazon aws-dataallAWS data.all vulnerable to RCE through user injection of Python CommandsCVE-2023-364678.0 High
- amazon aws cloud development kit, aws aws-cdk +1 moreAWS CDK EKS overly permissive trust policiesCVE-2023-35165Fix available6.6 Medium
- amazon alexaAmazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices...CVE-2023-332487.6 High
- amazon opensearch, embysupport security, amazon opensearch security +2 moreOpenSearch issue with fine-grained access control during extremely rare race conditionsCVE-2023-31141Fix available4.8 Medium
- amazon fire tv stick 3rd gen, insignia tv with fireos, amazon fire os +2 moreImproper JPAKE implementation allows offline PIN brute-forcing due to the initialization of...CVE-2023-13857.1 High
- amazon fire tv stick 3rd gen, insignia tv with fireos, amazon fire os +2 moreThe setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter...CVE-2023-13844.3 Medium
- amazon fire tv stick 3rd gen, insignia tv with fireos, amazon fire os +2 moreAn Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices...CVE-2023-13835.4 Medium
- amazon aws-sigv4, awslabs aws-sdk-rust +1 moreAWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sendingCVE-2023-30610Fix available5.5 Medium
- amazon opensearch, opensearch security, embysupport security +2 moreTime discrepancy in authentication responses in OpenSearchCVE-2023-25806Fix available5.3 Medium
- amazon opensearch, opensearch-project anomaly-detection +1 moreIssue in Anomaly Detection with document and field level rules in numerical feature aggregationsCVE-2023-239335.7 Medium
- amazon opensearch, embysupport security +1 moreIssue with whitespace in JWT roles in OpenSearchCVE-2023-23612Fix available4.7 Medium
- amazon opensearch, embysupport security +1 moreField-level security issue with .keyword fields in OpenSearchCVE-2023-23613Fix available5.7 Medium
- amazon efs-utils, elastic file system container storage interface driver +1 moreRace condition during concurrent TLS mounts in efs-utilsCVE-2022-46174Fix available4.2 Medium
- amazon aws sdk, aws software development kit +1 moreAWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgeryCVE-2022-4725Fix available5.5 Medium
- amazon cloudwatch agent, aws amazon-cloudwatch-agent +1 moreAmazon CloudWatch Agent for Windows has Privilege Escalation VectorCVE-2022-23511Fix available7.1 High
- amazon opensearch, embysupport security +1 moreIssue with fine-grained access control of indices backing data streamsCVE-2022-41918Fix available6.3 Medium
- amazon opensearchIncorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearchCVE-2022-419174.3 Medium
- amazon opensearch notifications, opensearch-project notifications +1 moreOpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)CVE-2022-419067.7 High
- amazon web services redshift java database connectivity drivercom.amazon.redshift:redshift-jdbc42 vulnerable to remote command executionCVE-2022-41828Public exploitFix available8.1 High
- amazon fhir-works-on-aws-authz-smartSecurity issue in fhir-works-on-aws-authz-smartCVE-2022-39230Fix available6.5 Medium
- amazon opensearch, embysupport security +1 moreOpenSearch vulnerable to Improper Authorization of Index Containing Sensitive InformationCVE-2022-35980Fix available7.5 High
- amazon aws-sdk-javaPartial Path Traversal in com.amazonaws:aws-java-sdk-s3CVE-2022-31159Public exploitFix available7.9 High
- amazon opensearch, opensearch-project opensearch-ruby +1 moreUnsafe YAML deserialization in opensearch-rubyCVE-2022-31115Fix available8.8 High
- amazon hotpatchVersions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3...CVE-2022-339157.0 High
- amazon ssm agentAmazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows...CVE-2022-29527Fix available7.0 High
- Show moreLoading…