Skip to content
Threat Feed
Subscribe

Tag

Data-Collection

5 briefs RSS
medium advisory

Sensitive File Compression Detected in Linux Containers for Credential Access

Elastic Defend for Containers detects the use of compression utilities like tar or zip within Linux containers to collect sensitive files such as SSH keys, AWS credentials, or system configurations, indicating potential credential access and data collection attempts by adversaries.

Defend for Containers container linux credential-access data-collection threat-detection discovery reconnaissance network-scanning +6
3r 8t 1i
high advisory

etcd Watch API Authorization Bypass via Open-Ended Range Requests

An authorization bypass vulnerability (GHSA-xg4h-6gfc-h4m8) in etcd's Watch API allows an authenticated user with READ permission on a single key to exploit the `clientv3.WithFromKey()` function, gaining unauthorized access to monitor and receive events for all keys lexicographically greater than or equal to their permitted key in clusters with authentication enabled.

etcd +2 authorization-bypass rbac data-collection
3t
high threat

B2B Platform Paywall Bypass via Client-Side Boolean Manipulation

An autonomous Red Agent discovered a critical business-logic flaw in a B2B platform's data API, allowing free-tier users to bypass the paywall and access premium, unmasked contact data for over 600 million profiles by adding a boolean flag, `unmaskContactData: true`, to standard API requests, due to the backend accepting client-controlled parameters without verifying user entitlements.

Red Agent business-logic-flaw authorization-bypass api-security red-team data-collection
2t
high advisory

CVE-2026-8377: Missing Authorization in Armiya GKS Allows Data Collection

A critical Missing Authorization vulnerability (CVE-2026-8377) in Armiya Information Technologies Ltd. Co.'s Access Control System (GKS) before Version 2 allows an unauthenticated or unauthorized attacker to collect sensitive data from common resource locations, leading to unauthorized information disclosure.

Access Control System vulnerability access-control-system missing-authorization data-collection critical-infrastructure
2t 1c
medium advisory

AWS RDS DB Instance Restored for Defense Evasion or Data Collection

Detection of AWS RDS database instance restoration from a snapshot or S3 backup, potentially indicating unauthorized data access, defense evasion, or data collection by adversaries recreating database environments to bypass controls or exfiltrate sensitive data.

RDS cloud aws defense-evasion data-collection
3r 3t