Welcome to another Afternoon Dessert breakout:
Why Do User Permissions Matter for SaaS Security?
Earlier this year, threat actors infiltrated Mailchimp, the popular SaaS email marketing platform. They viewed over 300 Mailchimp customer accounts and exported audience data from 102 of them. The breach was preceded by a successful phishing attempt and led to malicious attacks against Mailchimp’s customers’ end users.
Three months later, Mailchimp was hit with another attack. Once again, an
Read more….
New Study Uncovers Text-to-SQL Model Vulnerabilities Allowing Data Theft and DoS Attacks
A group of academics has demonstrated novel attacks that leverage Text-to-SQL models to produce malicious code that could enable adversaries to glean sensitive information and stage denial-of-service (DoS) attacks.
“To better interact with users, a wide range of database applications employ AI techniques that can translate human questions into SQL queries (namely Text-to-SQL),” Xutan Peng, a
Read more….
RSA crypto cracked? Or perhaps not!
Stand down from blue alert, it seems… but why not plan your cryptographic agility anyway?
Read more….
Kinsing Cryptojacking Hits Kubernetes Clusters via Misconfigured PostgreSQL
The threat actors behind the Kinsing cryptojacking operation have been spotted exploiting misconfigured and exposed PostgreSQL servers to obtain initial access to Kubernetes environments.
A second initial access vector technique entails the use of vulnerable images, Sunders Bruskin, security researcher at Microsoft Defender for Cloud, said in a report last week.
Kinsing has a storied history of
Read more….
CircleCI – code-building service suffers total credential compromise
They’re saying “rotate secrets”… in plain English, they mean “change your credentials”. The company has a tool to help you find them all.
Read more….
UK Environment Agency site hacked to redirect to OnlyFans phish
Threat actors abused an open redirect on the official website of the United Kingdom’s Department for Environment, Food & Rural Affairs (DEFRA) to direct visitors to fake OnlyFans adult dating sites. […]
Read more….
Microsoft fixes Windows 11 bug behind 0x800700b7 provisioning errors
Microsoft has addressed a known issue breaking provisioning on Windows 11 22H2 systems and leaving enterprise endpoints partially configured and failing to finish installing. […]
Read more….
Auth0 fixes RCE flaw in JsonWebToken library used by 22,000 projects
Auth0 fixed a remote code execution vulnerability in the immensely popular ‘JsonWebToken’ open-source library used by over 22,000 projects and downloaded over 36 million times per month on NPM. […]
Read more….
Follow for more…
amoran.io 