⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
This article details a data leak from the Vatican's official prayer app, which exposed over 700,000 users' personally identifiable information. A poorly secured API endpoint allowed anyone with a browser to access names, email addresses, and countries of users.
A Vatican prayer application exposed the personal data of over 700,000 users through a poorly secured API that leaked names, email addresses, country of origin, and application status information globally. The porous API did not require proper authentication or authorization checks, allowing anyone who discovered the endpoint to access the complete user database.
Microsoft fixed a default configuration setting in Azure Automation that was set to public-by-default, combined with code-level flaws that collectively enabled cross-tenant takeover attacks. The vulnerability allowed an attacker in one Azure tenant to gain unauthorized access to automation accounts and resources in other tenants, potentially compromising runbooks, credentials, and automated workflows across organizational boundaries.
Microsoft addresses a public-by-default configuration and chain of code flaws in Azure Automation that could have let attackers seize another tenant's identity and access others' data, credentials, and cloud workloads.
This article discusses a security flaw in Azure Automation caused by a default configuration that allowed cross-tenant identity takeover. Attackers could exploit this to seize another tenant's identity and access their data, credentials, and cloud workloads.
SentinelOne highlights a shift in cybersecurity operations, emphasizing AI-driven capabilities over traditional tools. Organizations struggle with overwhelming data from endpoints, firewalls, cloud systems, and more, requiring rare and costly human expertise to analyze.