Cloud Security

Vulnerabilities

Issued by: Security Week

The API allows add-ons to control the manner in which the browser connects to the Internet, and some extensions were found to abuse this. Specifically, the manner in which the offending add-ons interacted with the API prevented users from accessing updated blocklists, from downloading updates, and from updating content remotely configured. According to Mozilla, a…

Application Security, Cloud Security

Issued by: Security Week

A total of nine cybersecurity-related acquisitions were announced in the first 10 days of October 2021. 11:11 Systems acquires Green Cloud Defense Managed infrastructure solutions provider 11:11 Systems acquired Green Cloud Defense, a cloud infrastructure-as-a-service provider that specializes in managed cloud security solutions. The deal will help 11:11 Systems expand its capabilities and grow its…

Cloud Security

Issued by: Security Week

The company’s agentless CNAPP solution aims to secure multi-cloud IaaS and PaaS environments, as well as containers and data, through a single, unified interface. Founded in February 2021, the Santa Clara, California-based company offers support for major cloud infrastructure providers, including AWS, Azure, Google, IBM, and Oracle. Microsec.ai claims to provide visibility into containers, microservices,…

Vulnerabilities

Issued by: Security Week

The ESET discovery is the second real-world UEFI bootkit to be publicly documented in recent weeks, following Kaspersky’s report on a new Windows UEFI bootloader fitted into the FinSpy surveillance spyware product. According to ESET researchers Anton Cherepanov and Martin Smolar, the malware has evaded detection for almost a decade and was engineered to bypass…

Cloud Security

Issued by: Security Week

Trusted Cloud Principles signatories say they are committed to maintaining consistent human rights standards across their services, while also ensuring that cloud services providers’ interests are protected. The initiative has received support from heavy industry names, including Amazon, Atlassian, Cisco, Google, Microsoft, and IBM, among others. “Trusted Cloud Principles signatories are committed to protecting the…

Cloud Security

Issued by: Security Week

The vulnerability was found by security researcher Imre Rad, who disclosed his findings last week on the Full Disclosure mailing list. Rad found the vulnerability in Extensible Service Proxy (ESP), an open source, Nginx-based proxy that enables API management capabilities for JSON/REST or gRPC API services. Its features include authentication, monitoring and logging. ESP is…

Mobile Security

Issued by: Security Week

This is the 16th documented in-the-wild zero-day exploitation of security defects in Apple’s iOS and macOS platforms so far this year. “Apple is aware of reports that an exploit for this issue exists in the wild,” the company said without elaborating. No other details of IOCs (indicators of compromise) were provided. The Cupertino, Calif. software…

Vulnerabilities

Issued by: Security Week

A fully managed NoSQL database, Cosmos DB was launched in 2017, for use with web and mobile applications, but also supports modeling social interactions and integration with third-party services. Earlier this month, researchers with the cloud security firm Wiz discovered a vulnerability in the Azure cloud platform that could allow a remote attacker to take…