Imperva® Offers Free Serverless Protection for AWS Lambda

Just as other instant computing infrastructures have done in the past, Function-as-a-Service FaaS now enables DevOps teams to deploy applications more efficiently at a fraction of the cost. AWS Lambda, Amazon Web Services’ AWS serverless approach to infrastructure, enables companies to go-to-mark...

What’s New in InsightAppSec and tCell: Q1 2021 in Review

2021 is off and running! The big question on the corporate world’s mind is, of course, “What will work life look like at the end of 2021?” With vaccines rolling out around the world, another shift is set to take place around when and where people put in their hours. As offices slowly start to...

What’s new on AWS Lambda in 2021

This article explores new updates and documentation for AWS Lambda in 2021. Lambda launched several new updates including run container images, cost saving initiatives, and expanded compute capacity...

Rapid7 Announces Release of New tCell Amazon CloudFront Agent

Cloud-native approaches to building, hosting, and delivering web applications are growing rapidly. Content delivery networks CDNs such as Amazon CloudFront are on the rise, pushing content closer to end users to improve the performance of web applications. To protect web applications security tea...

Out-of-bounds (OOB) Read/Write

tensorflow is vulnerable to out-of-bounds OOB read/write. Lack of proper handling of the last argument of Shard API, a function taking two arguments of the lambda allows an attacker to lead to a truncation of arguments from positive int64 values to negative int ones, resulting in a buffer out of...

PYSEC-2020-317

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the Shard API in TensorFlow expects the last argument to be a function taking two int64 i.e., long long arguments. However, there are several places in TensorFlow where a lambda taking int or int32 arguments is being used. In...

Automated Discovery and Assessment of PaaS Databases with Lambda Service for Qualys Policy Compliance

In the last several years, Platform as a Service PaaS solutions have evolved and matured. As organizations have focused on digital transformation, there has been a major shift towards adopting PaaS solutions driven by benefits including scalability, agility, faster deployment, and cost-effective...

DAGOBAH - Open Source Tool To Generate Internal Threat Intelligence, Inventory & Compliance Data From AWS Resources

Dagobah is an open source tool written in python to automate the internal threat intelligence generation, inventory collection and compliance check from different AWS resources. Dagobah collects information and save the state into an elasticsearch index. Dagobah runs into the a LAMBDA and looks a...

Reflected XSS in GraphQL Playground

Impact directly impacted: - [email protected] - all unsanitized user input for renderPlaygroundPage all of our consuming packages of graphql-playground-html are impacted: - [email protected] - unsanitized user input to expressPlayground -...

CVE-2020-4038: Improper Neutralization of Input During Web Page Generation

GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...

Information Exposure

Overview Versions of apollo-server-lambda prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relatio...

@forecastr/api (>=0.0.4, <=0.0.5), @hammerframework/api (>=0.0.1-alpha.13, <=0.0.1-alpha.14) +8 more potentially affected by unknown CVE via apollo-server-lambda (>=2.0.0-xrc.11, <=2.11.0)

apollo-server-lambda NPM version =2.0.0-xrc.11, =0.0.4, =0.0.1-alpha.13, =0.0.1-alpha.12, =1.1.0, =0.0.1-alpha.27, =1.0.0, =1.2.1 - photos-production-api 1.0.0 - redwood-express-api 0.8.1 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

lambda-tdk.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1154958 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting lambda-tdk.ru website and...

@xapp/stentor (>=1.13.9, <=1.15.0) potentially affected by CVE-2019-10777 via aws-lambda (>=1.0.0, <=1.0.4)

aws-lambda NPM version =1.0.0, =1.13.9, =1.15.0 Source cves: CVE-2019-10777 Source advisory: OSV:GHSA-934X-72XH-5HRG...

GHSA-934X-72XH-5HRG OS command injection in aws-lambda

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

OS command injection in aws-lambda

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

Automating API Security in the Cloud

These days, the most common way for services to communicate and transfer data is by using APIs. However, broken, exposed, or hacked APIs are the cause of some of the latest major data breaches, as they have the potential to expose sensitive data for public consumption. Securing your APIs is...

aws-lambda operating system command injection vulnerability

AWS-Lambda is a computing service that runs code without pre-configured or managed servers. An operating system command injection vulnerability exists in versions of aws-lambda prior to 1.0.5, which stems from a program that fails to perform any cleanup operations before using config.FunctioName ...

Arbitrary Command Injection

aws-lambda is vulnerable to arbitrary command injection. The vulnerability exists due to the lack of sanitization on the value of config.FunctionName, allowing injection payloads to reach the exec function...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...