Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 14 are already weaponised in the wild — see the Exploited section.
ALAS-2019-1315: php71, php72, php73, php56 (critical)
CVEs:CVE-2019-11043
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| php71, php72, php73, php56 | affected | Amazon | php71, php72, php73, php56 | — |
ALAS-2019-1314: python27, python34, python35, python36 (medium)
CVEs:CVE-2019-16056
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| python27, python34, python35, python36 | affected | Amazon | python27, python34, python35, python36 | — |
ALAS-2019-1313: openssh (medium)
CVEs:CVE-2018-20685CVE-2019-6109CVE-2019-6111
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| openssh | affected | Amazon | openssh | — |
ALAS-2019-1310: exim (critical)
CVEs:CVE-2019-16928
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| exim | affected | Amazon | exim | — |
ALAS-2019-1311: httpd24 (medium)
CVEs:CVE-2019-10081CVE-2019-10082CVE-2019-10092CVE-2019-10097CVE-2019-10098CVE-2019-9517
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| httpd24 | affected | Amazon | httpd24 | — |
ALAS-2019-1312: patch (important)
CVEs:CVE-2016-10713CVE-2018-20969CVE-2018-6952CVE-2019-13638
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| patch | affected | Amazon | patch | — |
ALAS-2019-1309: sudo (important)
CVEs:CVE-2019-14287
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| sudo | affected | Amazon | sudo | — |
MIT and UC San Diego Researchers Publish Report
Linux Kernal Vulnerability in Certain EC2 AMIs
CVEs:CVE-2009-2692
UDP Traffic to EC2 Instances
Linux 2.6 Kernel Vulnerability in Certain EC2 AMIs
SSL and TLS Renegotiation Vulnerabilities
Zeus Botnet Controller
SIP Abuse
Gmail Accounts Accessed by EC2 IPs
Possible Insecure Memcached Configuration
Linux Kernel IA32 System Call Emulation Vulnerability
Amazon Payments Signature Validation
Windows CIFS Browser Protocol Heap Corruption Vulnerability
Reminder about Safely Sharing and Using Public AMIs
Morto Worm Spreading via Remote Desktop Protocol
Reported SOAP Request Parsing Vulnerabilities
JBoss Worm Spreading via Unpatched or Unsecured JBoss Application Server
CVEs:CVE-2010-0738
Microsoft Windows RDP Vulnerability
CVEs:CVE-2012-0002
Xen Security Advisories
Microsoft Windows RDP Vulnerability 06152012
Xen Security Advisories
CVEs:CVE-2012-3494CVE-2012-3495CVE-2012-3496CVE-2012-3497CVE-2012-3498CVE-2012-3515CVE-2012-3516CVE-2012-4411
Reported SSL Certificate Validation Errors in API Tools and SDKs
Red Hat and Other Third-party Public AMIs Security Concern
HeartBleed Bug Concern
CVEs:CVE-2014-0160
RDS PostgreSQL Updated to Address OpenSSL Vulnerability
AWS Services Updated to Address OpenSSL Vulnerability
CVEs:CVE-2014-0160
Heartbleed Bug Update
CVEs:CVE-2014-0160
Possible Insecure Elasticsearch Configuration
CVEs:CVE-2014-3120
OpenSSL Security Advisory
CVEs:CVE-2014-0224
CVE-2014-6271 Advisory
XSA Security Advisory 108
CVEs:CVE-2014-7188
CVE-2014-3566 Advisory
Amazon RDS – MySQL Security Advisory
MS14-066 Advisory
CVEs:CVE-2014-6321
Amazon RDS for Oracle Security Advisory
CVEs:CVE-2014-2478
OpenSSL Security Advisory (January)
Oracle Critical Patch (January 2015)
CVE-2015-0235 Advisory (Ghost)
CVEs:CVE-2015-0235
SSL Issue "FREAK Attack"
XSA Security Advisories
OpenSSL Security Advisory - March 2015
XSA Security Advisory CVE-2015-3456
CVEs:CVE-2015-3456
AWS to Switch to SHA256 Hash Algorithm for SSL Certificates
Update on AWS's Switch to SHA256 for SSL Certificates
OpenSSL Security Advisory - July 2015
CVEs:CVE-2015-1793
MS15-078 Advisory
XSA Security Advisory CVE-2015-5154
ISC BIND Security Advisory (CVE-2015-5477)
CVEs:CVE-2015-5477
Android Security Advisory
CVEs:CVE-2015-1538CVE-2015-1539CVE-2015-3824CVE-2015-3826CVE-2015-3827CVE-2015-3828CVE-2015-3829
MS15-093 Advisory
ISC BIND Security Advisory - September 2015
XSA Security Advisories
XSA Security Advisories
Juniper Security Advisory
CVE-2015-7547 Advisory
CVEs:CVE-2015-7547
CVE-2016-0800 Advisory
CVEs:CVE-2016-0800
ISC BIND Security Advisory - March
Microsoft and Samba Security Advisories - April 2016
OpenSSL Security Advisory - May 2016
XSA Security Advisory (XSA-179)
XSA Security Advisory (XSA-182)
CVEs:CVE-2016-6258
Xen Security Advisories - September 2016
Amazon RDS - MySQL Security Advisory (CVE-2016-6662)
CVEs:CVE-2016-6662
Amazon RDS Security Advisory (CVE-2016-6663 and CVE-2016-6664)
Xen Security Advisories - November 2016
Xen Security Advisory 200 (XSA-200)
ALAS-2019-1308: libarchive (medium)
CVEs:CVE-2017-14503CVE-2018-1000877CVE-2018-1000878CVE-2019-1000019CVE-2019-1000020
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| libarchive | affected | Amazon | libarchive | — |
ALAS-2019-1307: sssd (medium)
CVEs:CVE-2018-16838CVE-2019-3811
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| sssd | affected | Amazon | sssd | — |
ALAS-2019-1306: libtiff (medium)
CVEs:CVE-2016-3186CVE-2018-10779CVE-2018-10963CVE-2018-12900CVE-2018-17100CVE-2018-17101CVE-2018-18557CVE-2018-18661CVE-2018-7456CVE-2018-8905
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| libtiff | affected | Amazon | libtiff | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.