Amazon
Page 2 of 3 — Amazon CVEs from a corpus of 237, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10953 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their u… |
CVE-2024-8901 | High | 7.5 | 2024-10-22 | The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authenti… |
CVE-2024-10125 | High | 7.5 | 2024-10-22 | The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware… |
CVE-2024-45037 | Medium | 6.4 | 2024-08-27 | The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2024-38373 | Critical | 9.6 | 2024-06-24 | FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Respon… |
CVE-2024-37293 | High | 7.5 | 2024-06-11 | The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allow… |
CVE-2024-28056 | Critical | 9.8 | 2024-04-15 | Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication compo… |
CVE-2024-28115 | High | 8.8 | 2024-03-07 | FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege esca… |
CVE-2024-27350 | Medium | 5.9 | 2024-02-26 | Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. NOTE: some third pa… |
CVE-2024-23680 | Medium | 5.3 | 2024-01-19 | AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures. |
CVE-2024-21634 | High | 7.5 | 2024-01-03 | Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for application… |
CVE-2023-51386 | High | 7.8 | 2023-12-22 | Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated… |
CVE-2023-51651 | Medium | 6.0 | 2023-12-22 | AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix d… |
CVE-2023-50928 | High | 7.1 | 2023-12-22 | "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticate… |
CVE-2021-27504 | High | 7.4 | 2023-11-21 | Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow… |
CVE-2023-45807 | Medium | 5.4 | 2023-10-16 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implement… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-36467 | High | 8.0 | 2023-06-28 | AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do no… |
CVE-2023-35165 | Medium | 6.6 | 2023-06-23 | AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudF… |
CVE-2023-33248 | High | 7.6 | 2023-05-24 | Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant comman… |
CVE-2023-31141 | Medium | 4.8 | 2023-05-08 | OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the… |
CVE-2023-1385 | High | 7.1 | 2023-05-03 | Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authent… |
CVE-2023-1384 | Medium | 4.3 | 2023-05-03 | The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue a… |
CVE-2023-1383 | Medium | 5.4 | 2023-05-03 | An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register se… |
CVE-2023-30610 | Medium | 5.5 | 2023-04-19 | aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation… |
CVE-2023-24513 | Medium | 6.5 | 2023-04-12 | On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malf… |
CVE-2023-25806 | Medium | 5.3 | 2023-03-02 | OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authenticati… |
CVE-2023-23933 | Medium | 4.3 | 2023-02-03 | OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level… |
CVE-2023-23613 | Medium | 5.7 | 2023-01-26 | OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS)… |
CVE-2023-23612 | Medium | 4.7 | 2023-01-26 | OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when th… |
CVE-2022-46174 | Medium | 4.2 | 2022-12-28 | efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-utils v… |
CVE-2022-2582 | Medium | 4.3 | 2022-12-27 | The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plainte… |
CVE-2022-4725 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/mai… |
CVE-2022-23511 | High | 7.1 | 2022-12-12 | A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-p… |
CVE-2022-41917 | Medium | 4.3 | 2022-11-16 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to… |
CVE-2022-41918 | Medium | 6.3 | 2022-11-15 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules… |
CVE-2022-41906 | High | 8.7 | 2022-11-11 | OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-h… |
CVE-2022-41828 | High | 8.1 | 2022-09-29 | In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when i… |
CVE-2022-39230 | Medium | 6.5 | 2022-09-23 | fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposu… |
CVE-2022-35980 | High | 7.5 | 2022-08-12 | OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin ar… |
CVE-2022-34266 | Medium | 5.5 | 2022-07-19 | The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerabili… |
CVE-2022-31159 | High | 7.9 | 2022-07-15 | The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in t… |
CVE-2022-31115 | High | 8.8 | 2022-06-30 | opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used instead of `YA… |
CVE-2022-33915 | High | 7.0 | 2022-06-17 | Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local… |
CVE-2022-29527 | High | 7.0 | 2022-04-20 | Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges… |
CVE-2022-0070 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capa… |
CVE-2021-3100 | High | 8.8 | 2022-04-19 | The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate pr… |
CVE-2022-25166 | Medium | 5.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for… |
CVE-2022-25165 | High | 7.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters… |
CVE-2022-24709 | High | 8.8 | 2022-02-24 | @awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multip… |
CVE-2022-25809 | Critical | 9.8 | 2022-02-24 | Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on these devices via a mal… |
CVE-2021-44833 | Critical | 9.8 | 2021-12-12 | The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file. |
CVE-2021-43811 | High | 7.8 | 2021-12-08 | Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurati… |
CVE-2021-43638 | High | 8.8 | 2021-12-07 | Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers t… |
CVE-2021-43637 | High | 8.8 | 2021-12-07 | Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execut… |
CVE-2021-40831 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macO… |
CVE-2021-40830 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix… |
CVE-2021-40829 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and N… |
CVE-2021-40828 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and… |
CVE-2021-43997 | High | 7.8 | 2021-11-17 | FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privilege. FreeRTOS vers… |
CVE-2021-41150 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2021-41149 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2021-38112 | High | 8.8 | 2021-09-22 | In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution beca… |
CVE-2021-30355 | High | 8.6 | 2021-09-01 | Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privileges to root. |
CVE-2021-30354 | High | 8.6 | 2021-09-01 | Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function CJBig2Image::e… |
CVE-2020-36363 | Critical | 9.8 | 2021-08-12 | Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entities consider to be w… |
CVE-2021-37436 | Medium | 4.2 | 2021-07-24 | Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive informati… |
CVE-2021-31828 | High | 7.1 | 2021-05-06 | An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with confi… |
CVE-2021-32020 | Critical | 9.8 | 2021-05-03 | The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory. |
CVE-2021-31572 | Critical | 9.8 | 2021-04-22 | The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer. |
CVE-2021-31571 | Critical | 9.8 | 2021-04-22 | The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation. |
CVE-2020-28472 | High | 7.3 | 2021-01-19 | This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to… |
CVE-2020-8897 | Medium | 4.8 | 2020-11-16 | A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing propert… |
CVE-2020-27174 | High | 7.5 | 2020-10-16 | In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the s… |
CVE-2020-8912 | Low | 2.5 | 2020-08-11 | A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted b… |
CVE-2020-8911 | Medium | 5.6 | 2020-08-11 | A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without comp… |
CVE-2020-16843 | Medium | 5.9 | 2020-08-04 | In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial of service… |
CVE-2020-15093 | High | 8.6 | 2020-07-09 | The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicat… |
CVE-2019-14652 | Medium | 6.1 | 2020-02-13 | explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances. |
CVE-2019-10777 | Critical | 9.8 | 2020-01-08 | In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitizat… |
CVE-2019-3984 | Critical | 9.8 | 2019-12-31 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the… |
CVE-2019-3989 | Critical | 9.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when retr… |
CVE-2019-3988 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3987 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3986 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3985 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3983 | Medium | 6.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protectio… |
CVE-2019-18960 | Critical | 9.8 | 2019-12-11 | Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes. |
CVE-2019-11554 | Medium | 5.9 | 2019-12-06 | The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a denial of service. |
CVE-2019-18178 | High | 7.5 | 2019-11-04 | Real Time Engineers FreeRTOS+FAT 160919a has a use after free. The function FF_Close() is defined in ff_file.c. The file handler pxFile is freed by ffconfigFRE… |
CVE-2019-13120 | High | 7.5 | 2019-10-07 | Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents o… |
CVE-2018-19981 | High | 7.2 | 2019-04-04 | Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service… |
CVE-2019-9483 | Critical | 9.1 | 2019-03-01 | Amazon Ring Doorbell before 3.4.7 mishandles encryption, which allows attackers to obtain audio and video data, or insert spoofed video that does not correspon… |
CVE-2019-7399 | High | 7.4 | 2019-02-17 | Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages. |
CVE-2018-16603 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16602 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16601 | High | 8.1 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16600 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-16599 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |