Ian Mckay

An attacker with the ability to create CloudFormation stacks could cause
a denial-of-service on some CloudFormation actions within a single AWS account.


CloudFormation denial of service (in a single account)

Ezequiel Pereira

It was possible to list IAM service accounts of any GCP project, given only its ID, by forging a pageToken for the projects.serviceAccounts.list 
method of the IAM API. Due to the design of certain services in GCP, this issue could lead to exposure of sensitive information related to a project,
and could be further used to enumerate unsecured resources in the platform, such as App Engine apps, Container Registry repositories, etc.


GCP service accounts and projects information leak

Sophie Schmieg

S3 Crypto SDK vulnerabilities

The immutability of Lambda versions could be violated via a timing attack
against CloudWatch Synthetics canaries.


Timing attack with Lambda and CloudWatch Synthetics

Summary

Affected Services

Remediation

Tracked CVEs

References

More vulnerabilities...

CloudFormation denial of service (in a single account)

Ian Mckay

GCP service accounts and projects information leak

Ezequiel Pereira

S3 Crypto SDK vulnerabilities

Sophie Schmieg, Google