Changli

A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue.

**Name of the Vulnerable Software and Affected Versions** 3CORESec Trapdoor versions prior to 1.2.3 **Description** Improper access controls exist in the `DefaultFunction()` function, which allows a remote attacker to manipulate the system. **Recommendations** Update 3CORESec Trapdoor to version 1.2.3 or later. As a temporary workaround, consider restricting access to the `DefaultFunction()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** nxp-auto-goldvip gvip versions prior to 1.13.0 **Description** Improper access controls exist within the Lambda Function Handler component, specifically affecting the `SitewiseCustomFunction()` function. This issue stems from an IAM permission configuration and allows for remote attacks. **Recommendations** Update to version 1.15.0. As a temporary mitigation, restrict access to the `SitewiseCustomFunction()` function.

**Name of the Vulnerable Software and Affected Versions** wongcyrus ExcelLexBot versions prior to 0.0.4 **Description** Improper privilege management exists within the Lambda Function Handler component, specifically affecting the `ExcelLexBotS3TriggerFunction()` function. This issue allows a remote attacker to perform manipulations that result in incorrect privilege handling. This flaw affects products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `ExcelLexBotS3TriggerFunction()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** lmammino oidc-authorizer version 0.4.0 **Description** A flaw in the Authorization Header Parsing component allows remote attackers to cause a denial of service. The issue occurs within the `parse token from header()` function located in the `src/parse token from header.rs` file when the `authorization token` argument is manipulated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `parse token from header()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** lmammino oidc-authorizer versions prior to 0.4.1 **Description** The Lambda Authorizer component contains an issue where raw Authorization header values and complete bearer tokens or JWTs are logged on authentication failure paths, potentially exposing credentials through CloudWatch Logs. Additionally, the `unwrap()` function in the `src/handler.rs` file is impacted. The system serializes the complete validated JWT claims set using `serde json::to string(token claims).unwrap()` and propagates it through the `jwtClaims` variable to downstream integrations. This issue can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.