There are serious vulnerabilities in Google App Engine, a cloud service for developing and hosting Web applications, a team of security researchers has found.