com.bertramlabs.plugins:ratpack-asset-pipeline (>=2.2.7, <=4.3.0), com.bytekast.serverless-local-apigateway:com.bytekast.serverless-local-apigateway.gradle.plugin (>=0.4-snapshot, <=0.5) +87 more potentially affected by CVE-2019-10770 via io.ratpack:ratpack-core (>=0.9.0, <=1.7.5)

io.ratpack:ratpack-core MAVEN version =0.9.0, =2.2.7, =0.4-snapshot, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.2, =1.2, =1.3, =1.1, =1.1, =1.5, =1.1, =1.8 and more Source cves: CVE-2019-10770 Source advisory: MEND:CVE-2019-10770...

AlertResponder - Automatic Security Alert Response Framework By AWS Serverless Application Model

AlertResponder is a serverless framework for automatic response of security alert. Overview AlertResponder receives an alert that is event of interest from security view point and responses the alert automatically. AlertResponder has 3 parts of automatic response. 1. Inspector investigates entiti...

Serverless ETLs? Easy Data Lake Transformations using AWS Athena

In a data lake raw data is added with little or no processing, allowing you to query it straight away. This gives you a great way to learn about your data - whether it represents a quick win or a fast fall. However, there are two disadvantages: performance and costs. If, for example you added CSV...

Taking Reputation to Scale: An Iterative Journey with an Agile Approach (Part 2)

In Part 1 of this blog, we shared with you the challenges we had in balancing latency, scalability, and cost for our reputation services. In this blog, we’ll give you some insights into each major iteration along that journey, from the beginning to where we are now. 100 requests per second. Befor...

Introducing Serverless Computing at the Edge with Akamai EdgeWorkers

For the first time, Akamai is introducing an all-new serverless compute capability to help you customize web traffic, expanding the possibilities of personalized engagement with your customers while putting the flexibility and control in the hands of your developers. Developers can now manipulate...

CVE-2019-10397

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...

Code injection

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2019-10397

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2019-10397

The CVE-2019-10397 entry concerns the Jenkins Aqua Security Serverless Scanner Plugin, affecting version 1.0.4 and earlier. The root issue is that configured passwords were transmitted in plain text as part of job configuration forms, potentially exposing credentials. Publicly available connected...

CVE-2019-10397

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2019-10397: Cleartext Transmission of Sensitive Information

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...

aqua-serverless showed plain text password in job configuration form fields

aqua-serverless stores service passwords in job configurations. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and...

anjiayi-elf (>=1.0.0, <=1.0.9), anjiayi-exp (>=1.0.0, <=1.2.6) +5 more potentially affected by unknown CVE via lutils-merge (>=0.1.4, <=0.2.6)

lutils-merge NPM version =0.1.4, =1.0.0, =1.0.0, =1.0.0, =0.0.1-alpha, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: GHSA-F7QW-5PVG-MMWP...

com.bytekast.serverless-local-apigateway:com.bytekast.serverless-local-apigateway.gradle.plugin (>=0.4-snapshot, <=0.5), gradle.plugin.com.bytekast:serverless-local-apigateway (>=0.4-snapshot, <=0.5) +1 more potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (>=1.0.0-rc-1, <=1.6.0)

io.ratpack:ratpack-groovy MAVEN version =1.0.0-rc-1, =0.4-snapshot, =0.4-snapshot, =1.0.0-rc-1, =1.6.0 Source cves: CVE-2019-11808 Source advisory: GHSA-54MG-VGRP-MWX9...

com.bytekast.serverless-local-apigateway:com.bytekast.serverless-local-apigateway.gradle.plugin (>=0.4-snapshot, <=0.5), gradle.plugin.com.bytekast:serverless-local-apigateway (>=0.4-snapshot, <=0.5) +1 more potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (>=0.9.0, <=1.6.0)

io.ratpack:ratpack-groovy MAVEN version =0.9.0, =0.4-snapshot, =0.4-snapshot, =0.9.0, =1.6.0 Source cves: CVE-2019-11808 Source advisory: MEND:CVE-2019-11808...

QSC18: The Need for Security Visibility in the Age of Digital Transformation

Enterprises are moving full steam ahead when it comes to their digital transformation efforts. They’ve aggressively adopted cloud infrastructure and other cloud services, IoT, application containers, serverless functionality, and other technologies that are helping their organization to drive...

Apache, IBM Patch Critical Cloud Vulnerability

Apache and IBM have patched a critical vulnerability that allows attackers to replace a company’s serverless code with their own malicious script. Once running, the bad code could then be used for a range of nefarious tasks, including extracting confidential customer data such as passwords or...

IBM fixes flaw that let hackers replace its serverless code with their own

By Waqas This is the first publicly-disclosed vulnerability in a serverless platform. Experts at IBM The International Business Machines Corporation have patched a critical vulnerability in its Cloud Functions which if exploited could allow remote malicious hackers to replace company's serverless...

Serverless, Low Cost, Threat Intel Aggregation: ElasticIntel

ElasticIntel is serverless, low cost, threat intel aggregation for enterprise or personal use, backed by ElasticSearch. It is an alternative to expensive threat intel aggregation platforms which ingest the same data feeds you could get for free. ElasticIntel is designed to provide a central,...

This Week in Security News: Trojans and Cyber Hacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Read on for the latest on trojanized malware, smart phone hacks, and cybersecurity legislation. Dark Caracal Group Revealed: Group Used Trojanized...