Information

A cross-tenant vulnerability in Amazon Web Services (AWS) could have allowed attackers to abuse AWS AppSync to gain access to resources in an organization’s account. An attacker could exploit the AWS AppSync service to assume identity and access management (IAM) roles in other AWS accounts, gaining access to resources within those accounts, cloud security company Datadog Security Labs explains. The AppSync service allows developers to create GraphQL and Pub/Sub APIs, each with an associated data…

Read More

Facebook parent Meta has tied a recent influence operation powered by tens of accounts, pages and groups to the United States military. The social media giant on Tuesday released its adversarial threat report for the third quarter of 2022. During Q3, in addition to disrupting operations linked to Chinese and Russian threat actors, the company disrupted an operation that has been connected to the United States. According to Meta, the operation that originated in the…

Read More

Threat detection firm CloudSEK has identified thousands of applications leaking Algolia API keys, and tens of applications with hardcoded admin secrets, which could allow attackers to steal the data of millions of users. Organizations can use Algolia’s API to incorporate into their applications functions such as search, discovery, and recommendations. The API is used by over 11,000 companies, including Lacoste, Slack, Medium, and Zendesk. CloudSEK says it has identified 1,550 applications that leaked Algolia API…

Read More

The County of Tehama, California, has started informing employees, recipients of services, and affiliates that their personal information might have been compromised in a data breach. The incident, Tehama County says, was identified on April 9, but the investigation into the matter stretched to August 19, when it was determined that personally identifiable information (PII) was compromised. The investigation revealed that an unauthorized third-party had access to the county’s systems between November 18, 2021, and…

Read More

Atlassian informed customers this week that it has patched critical vulnerabilities in its Crowd and Bitbucket products. In the Bitbucket source code repository hosting service, Atlassian fixed CVE-2022-43781, a critical command injection vulnerability that affects Bitbucket Server and Data Center version 7 and, in some cases, version 8. “There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue…

Read More