Discovered Vulnerabilities
Oracle Server Side Request Forgery (SSRF) Metadata
Analyzing customer environments is always a detective task, and when we find structural flaws in a service provider, this is...
Blog
Discovered Vulnerabilities
A Tale About Vulnerability Research and Early Detection
Orca Security, as part of an ongoing research effort, discovered a vulnerability in the Databricks platform, and Databricks took swift...
Research
Orca Cloud Risk Encyclopedia: The Ultimate Resource for Security Practitioners
Orca Security's Cloud Risk Encyclopedia is a collection of 900+ cloud risks along with remediation strategies for AWS, Azure, and...
Ensure the default ulimit is configured appropriately (Manual)
ulimit provides control over the resources available to the shell and to processes which it starts. Setting system resource limits...
Elasticsearch domain has less than three data nodes
Amazon OpenSearch Service (Amazon Elasticsearch Service successor) is a managed service that simplifies the deployment, operation, and scaling of OpenSearch...
RDS PostgreSQL doesn’t have duration log
Alibaba Cloud ApsaraDB for RDS is an online database service for easy operation, manage and scale relational databases. Enabling 'log_duration'...
Elasticsearch error logs disabled
Amazon OpenSearch Service (Amazon Elasticsearch Service successor) is a managed service that simplifies the deployment, operation, and scaling of OpenSearch...
Elasticsearch audit logs disabled
Amazon OpenSearch Service (Amazon Elasticsearch Service successor) is a managed service that simplifies the deployment, operation, and scaling of OpenSearch...
Security Center High Severity Alerts Not Notified
Enabling security alert emails to subscription owners ensures that they receive security alert emails from Microsoft. This ensures that they...