Content Security Policies with Sven Morgenroth, Netsparker – Paul’s Security Weekly #536

Hackread reports that more than 30,000 internet-exposed instances of widely used cloud-based API development and testing platform Postman Workspace had API keys, tokens, and admin credentials exposed as a result of access control misconfiguration, accidental Postman collection sharing, public repository syncing, and unencrypted storage of plaintext data.

Malicious actors have distributed Android spyware as the BMI CalculationVsn app through the Amazon Appstore.

The installed plugins contain exploitable flaws, such as remote code execution, SQL injection, and cross-site scripting, allowing attackers to compromise targeted websites.