cloudvulndb

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues ☁️⚠️

[cloudvulndb @cloudvulndb]

- RSS feed is now ordered by publication date
- New template for simple contribution of information about a vulnerability or security issue: https://t.co/W6kfOdxHcj

2/2

[cloudvulndb @cloudvulndb]

We've made some updates!
- New website logo
- 137 total vulnerabilities and security issues added by 24 contributors (65 added since website launch)
- New tag system allows searching for issues with specific severities in each CSP: https://t.co/dplxp5JxpG

🧵1/2

[cloudvulndb @cloudvulndb]

@MoorcroftJustin Great find! We added it to cloudvulndb. https://t.co/NLkGCIDkuA

[cloudvulndb @cloudvulndb]

@mdecrevoisier This does not seem to be a security mistake by Azure which would fit our criteria of being a cloudvuln (note MSRC did not fix anything), but rather is a privilege escalation within a specific customer environment.

[cloudvulndb @cloudvulndb]

New issue: Azure AD B2C cryptographic flaw allowing account compromise
https://t.co/HDxdF7Wf5P
Severity: Critical
Discoverer: John Novak, Praetorian
#Azure #cloudsecurity

[Amitai Cohen @AmitaiCo]

Good to see Azure investing in this. @41thexplorer and I spoke about using @cloudvulndb for cross-industry variant analysis of cloud vulnerabilities in our talk at @fwdcloudsec 22' (https://t.co/xkqR2hjCpK)

[cloudvulndb @cloudvulndb]

New issue: AWS Console rate limit bypass
https://t.co/77Mex5Mraj
Severity: Medium
Discoverer: Christophe Tafani-Dereeper (@christophetd), Datadog
#AWS #cloudsecurity

[cloudvulndb @cloudvulndb]

New issue: EmojiDeploy
https://t.co/yKz74QIAYO
Severity: High
Discoverer: Liv Matan
#Azure #cloudsecurity

[cloudvulndb @cloudvulndb]

New issue: Multiple SSRF vulnerablities in Azure services https://t.co/eIVuSfOtNk

Severity: Low
Discoverer: Lidor Ben Shitrit

#Azure #cloudsecurity

[cloudvulndb @cloudvulndb]

New issue: AWS CloudTrail bypass for specific IAM actions https://t.co/N2vshtcoGk
Severity: Medium
Discoverer: @Frichette_n

#AWS #cloudsecurity

[cloudvulndb @cloudvulndb]

New issue: SSH key injection in Google Cloud Compute Engine https://t.co/QGq5SOsakV
Severity: High
Discoverer: @sivaneshashok
#GCP #cloudsecurity

[cloudvulndb @cloudvulndb]

New issue: https://t.co/E7zYNlK8kG
Severity: Medium
#Azure #cloudsecurity

[cloudvulndb @cloudvulndb]

New issue: https://t.co/umjWPk4doZ
Severity: Medium
#Azure

[cloudvulndb @cloudvulndb]

New issue: https://t.co/jckZZADR1o
Severity: Critical
#AWS

[cloudvulndb @cloudvulndb]

New issue: https://t.co/xsscrAzRPf
Severity: Critical
#IBM

[cloudvulndb @cloudvulndb]

New issue: https://t.co/sh6tFT87KA
Severity: High
#AWS

[cloudvulndb @cloudvulndb]

New issue: https://t.co/hRboNoSfuB
Severity: Undecided
#Azure

[cloudvulndb @cloudvulndb]

New issue: https://t.co/HCmCFz7Mp9
Severity: Medium
#Azure

[Mike @theomegabit]

And this is why things like the #CloudCVEdb are incredibly important. https://t.co/F6D5kEtVhl

[cloudvulndb @cloudvulndb]

We've downgraded this issue to high severity. We're actively working on better defining how we rate these issues. The pre-req that the attacker must know the volume ID was decided to be a significant barrier, along with the volume needing to be shared or unattached.

[cloudvulndb @cloudvulndb]

New issue: https://t.co/bzvztDJ3Tp
Critical #OracleCloud