PT-2022-1455

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 9.0.1 Description The issue allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used, potentially enabling a remote attacker to execute arbitrary...

PT-2021-6134 · Vim +4 · Vim +4

Name of the Vulnerable Software and Affected Versions: vim affected versions not specified Description: The issue is related to a heap-based buffer overflow in the vim text editor, specifically in the eval lambda function located in src/eval.c. This overflow occurs in dynamic memory and can be...

com.eoniantech:secrets-locker (>=1.0, <=1.1), com.github.seanroy:lambda-maven-plugin (>=2.3.2, <=2.3.3) potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (1.3.1)

com.amazonaws:aws-encryption-sdk-java MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - com.eoniantech:secrets-locker =1.0, =2.3.2, =2.3.3 Source cves: CVE-2020-8897 Source...

Serverless protection for execution environments made easy

Serverless computing is transforming the way we build, ship, automate, and scale applications. With no infrastructure to manage, organizations can move from ideation to market faster, with virtually no operational overhead. Consequently, these enterprises can now focus on just the code that serve...

lambda-tek.it Cross Site Scripting vulnerability OBB-2144289

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Secure Your Images with AWS Lambda Serverless Functions

NEW on AWS Lambda: Learn how to package up your serverless functions as container images...

Moving to AWS Lambda? Here’s what you need to know.

Serverless computing is transforming the way organizations build, ship, automate and scale applications. With no need to worry about infrastructure or who’s going to manage it, developers are free to focus on application development and innovation. The payoffs can be significant: Faster time to...

Security for AWS Lambda Serverless Applications

Serverless computing is another beautiful cloud-based advancement for developers. But, like all applications, proper security is required to maximize the benefits. Learn more in this article...

Nebula - Cloud C2 Framework, Which At The Moment Offers Reconnaissance, Enumeration, Exploitation, Post Exploitation On AWS

Nebula is a Cloud and hopefully DevOps Penetration Testing framework. It is build with modules for each provider and each functionality. As of April 2021, it only covers AWS, but is currently an ongoing project and hopefully will continue to grow to test GCP, Azure, Kubernetes, Docker, or...

Imperva® Offers Free Serverless Protection for AWS Lambda

Just as other instant computing infrastructures have done in the past, Function-as-a-Service FaaS now enables DevOps teams to deploy applications more efficiently at a fraction of the cost. AWS Lambda, Amazon Web Services’ AWS serverless approach to infrastructure, enables companies to go-to-mark...

What’s New in InsightAppSec and tCell: Q1 2021 in Review

2021 is off and running! The big question on the corporate world’s mind is, of course, “What will work life look like at the end of 2021?” With vaccines rolling out around the world, another shift is set to take place around when and where people put in their hours. As offices slowly start to...

What’s new on AWS Lambda in 2021

This article explores new updates and documentation for AWS Lambda in 2021. Lambda launched several new updates including run container images, cost saving initiatives, and expanded compute capacity...

Rapid7 Announces Release of New tCell Amazon CloudFront Agent

Cloud-native approaches to building, hosting, and delivering web applications are growing rapidly. Content delivery networks CDNs such as Amazon CloudFront are on the rise, pushing content closer to end users to improve the performance of web applications. To protect web applications security tea...

Out-of-bounds (OOB) Read/Write

tensorflow is vulnerable to out-of-bounds OOB read/write. Lack of proper handling of the last argument of Shard API, a function taking two arguments of the lambda allows an attacker to lead to a truncation of arguments from positive int64 values to negative int ones, resulting in a buffer out of...

PYSEC-2020-317

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the Shard API in TensorFlow expects the last argument to be a function taking two int64 i.e., long long arguments. However, there are several places in TensorFlow where a lambda taking int or int32 arguments is being used. In...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2019-20916 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

auto-dl (0.1.1), aws-lambda-sls (0.1.0) +53 more potentially affected by CVE-2019-20916 via pip (>=1.5.6, <=19.1.1)

pip PYPI version =1.5.6, =0.0.0, =0.1.17, =1.0.1, =1.5.114, =3.4.13, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =2.4.0, =1.5.6, =1.5.8 and more Source cves: CVE-2019-20916 Source advisory: MEND:CVE-2019-20916...

Automated Discovery and Assessment of PaaS Databases with Lambda Service for Qualys Policy Compliance

In the last several years, Platform as a Service PaaS solutions have evolved and matured. As organizations have focused on digital transformation, there has been a major shift towards adopting PaaS solutions driven by benefits including scalability, agility, faster deployment, and cost-effective...

DAGOBAH - Open Source Tool To Generate Internal Threat Intelligence, Inventory & Compliance Data From AWS Resources

Dagobah is an open source tool written in python to automate the internal threat intelligence generation, inventory collection and compliance check from different AWS resources. Dagobah collects information and save the state into an elasticsearch index. Dagobah runs into the a LAMBDA and looks a...

Reflected XSS in GraphQL Playground

Impact directly impacted: - [email protected] - all unsanitized user input for renderPlaygroundPage all of our consuming packages of graphql-playground-html are impacted: - [email protected] - unsanitized user input to expressPlayground -...