AWS VDP Program Statistics

View program

47 total issues disclosed

$0 total paid publicly

Most disclosed (21 disclosures) — Insufficient Logging

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
V1Plugin.Decrypt panics on empty ciphertext (Remote DoS) Array Index Underflow misop00p Medium 2026-05-28
V2Plugin.Decrypt panics on empty ciphertext (Remote DoS) Array Index Underflow misop00p Medium 2026-05-28
QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial None supplied jcow None 2026-05-12
SQL Injection Detection Bypass in AWS WAF Managed Rules (AWSManagedRulesSQLiRuleSet) SQL Injection killnet-edc None 2026-04-15
Encryption context keys and values logged at INFO level Insertion of Sensitive Information into Log File misop00p None 2026-04-10
Health check errors silently dropped when channel buffer full None supplied misop00p None 2026-04-07
Arbitrary Code Execution via Scanner Bypass in **aws-diagram-mcp-server** `exec()` Namespace None supplied locus-x64 None 2026-03-09
Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy Violation Weak Password Requirements h0ne_analyst_94cm4n1 None 2026-02-26
Unlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████ Business Logic Errors aneeeketh Low 2026-02-09
Command Injection on Amazon Q Developer CLI via malicious .amazonq/mcp.json leads to arbitrary code execution Command Injection - Generic farmer None 2026-01-16
Non-Production API Endpoints for the AI Ops Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2026-01-06
AWS Auto Scaling Service Reporting "AWS Internal" for CloudTrail Events Generated from Specific Endpoints Insufficient Logging nick_frichette_dd Medium 2026-01-05
Existence of completed pods allows for bypass of Kubernetes NetworkPolicy Improper Access Control - Generic savannabungee Medium 2025-11-19
Responsible disclosure - public S3 bucket exposing JSON/config files Information Disclosure xtawb Low 2025-11-14
AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMs Authentication Bypass Using an Alternate Path or Channel notnotnotveg Low 2025-08-25
Remote Code Execution in Amazon MWAA due to outdated Apache Airflow version Code Injection ricardojoserf None 2025-08-14
XSS on Amazon Aquisition: elemental Cross-site Scripting (XSS) - Reflected muhammad_kasim High 2025-07-22
Private AWS AMIs are temporarily being exposed publicly None supplied seth_art_dd None 2025-05-29
Non-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-05-28
Non-Production API Endpoints for the bedrock Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-05-28
Non-Production API Endpoint for the EventBridge Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-05-28
Non-Production API Endpoints for the Global Accelerator Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-05-28
Non-Production API Endpoints for the Health Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-05-28
Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints Insufficient Logging nick_frichette_dd Medium 2025-05-28
Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints Insufficient Logging nick_frichette_dd Medium 2025-05-28
Non-Production API Endpoints for the Neptune Graph Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-05-27
Non-Production API Endpoints for the Route 53 Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-05-27
Bedrock Guardrails Evasion with Prompt Formatting None supplied nkirk-nrlabs None 2025-05-15
Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-04-25
Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-04-25
Non-Production API Endpoints for the Glue Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-04-25
Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-04-24
(Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-04-08
Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-03-24
Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-03-11
Session Timeout Does Not Enforce Re-Authentication on AWS Access Portal Reusing Session IDs (aka Session Replay) xendaviour Medium 2025-03-05
Non-Production API Endpoints for the Device Farm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-03-04
Sensitive API Key Leakage Cleartext Storage of Sensitive Information hemant1 Medium 2025-03-04
Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Insufficient Logging nick_frichette_dd Medium 2025-02-26
Amazon Comprehend Medical Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints Insufficient Logging nick_frichette_dd Medium 2025-02-25
A potential risk in the aws-lambda-ecs-run-task which can be used to privilege escalation. Incorrect Privilege Assignment zolaer9527 Medium 2024-12-27
Reflected XSS on Amazon EC2 Instance Reflected XSS perigou High 2024-12-24
CVE-2020-5902 Using Components with Known Vulnerabilities perigou Critical 2024-12-24
A potential risk in the cloudFrontExtensionsConsole which can be used to privilege escalation. Improper Access Control - Generic zolaer9527 Medium 2024-11-19
A potential risk in the experimental-programmatic-access-ccft which can be used to privilege escalation. Incorrect Privilege Assignment zolaer9527 High 2024-11-06
Information Disclosure Due To exposed .env file (Directory Listing) at ████████ Information Exposure Through Directory Listing necr0mancer High 2024-10-22
External service interaction (HTTP) Server-Side Request Forgery (SSRF) hesham_elsheme High 2024-10-04