An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues ☁️⚠️ https://xitter.cf/t.co/MbblEhAbax
Joined September 2021
- Tweets28
- Following3
- Followers490
- Likes11
We've made some updates!
- New website logo
- 137 total vulnerabilities and security issues added by 24 contributors (65 added since website launch)
- New tag system allows searching for issues with specific severities in each CSP: cloudvulndb.org/results?tags…
🧵1/2
- RSS feed is now ordered by publication date
- New template for simple contribution of information about a vulnerability or security issue: github.com/wiz-sec/open-cvdb…
2/2
New issue: Azure AD B2C cryptographic flaw allowing account compromise
cloudvulndb.org/azure-b2c-cr…
Severity: Critical
Discoverer: John Novak, Praetorian
#Azure #cloudsecurity
cloudvulndb retweeted
Good to see Azure investing in this. @41thexplorer and I spoke about using @cloudvulndb for cross-industry variant analysis of cloud vulnerabilities in our talk at @fwdcloudsec 22' (youtu.be/KwDo6KG76_c)
This Post is from an account that no longer exists. Learn more
New issue: AWS Console rate limit bypass
cloudvulndb.org/aws-console-…
Severity: Medium
Discoverer: Christophe Tafani-Dereeper (@christophetd), Datadog
#AWS #cloudsecurity
New issue: EmojiDeploy
cloudvulndb.org/emojideploy
Severity: High
Discoverer: Liv Matan
#Azure #cloudsecurity
New issue: Multiple SSRF vulnerablities in Azure services cloudvulndb.org/azure_multip…
Severity: Low
Discoverer: Lidor Ben Shitrit
#Azure #cloudsecurity
New issue: AWS CloudTrail bypass for specific IAM actions cloudvulndb.org/aws-iamadmin…
Severity: Medium
Discoverer: @Frichette_n
#AWS #cloudsecurity
New issue: SSH key injection in Google Cloud Compute Engine cloudvulndb.org/gce_ssh_key_…
Severity: High
Discoverer: @sivaneshashok
#GCP #cloudsecurity
cloudvulndb retweeted
And this is why things like the #CloudCVEdb are incredibly important. cloudvulndb.org/about
We've downgraded this issue to high severity. We're actively working on better defining how we rate these issues. The pre-req that the attacker must know the volume ID was decided to be a significant barrier, along with the volume needing to be shared or unattached.
New issue: cloudvulndb.org/attachme
Critical #OracleCloud
