978 matches found
Salesforce DX command line interface (CLI) does not adequately protect sfdxurl credentials
Overview The default security configuration in Salesforce allows an authenticated user with the Salesforce-CLI to create URL that will allow anyone, anywhere access to the Salesforce GUI with the same administrative credentials without a log trace of access or usage of the API. Description The...
CVE-2021-3825
CVE-2021-3825 affects the Lider module of LiderAhenk software, specifically versions 2.1.15 and earlier. The root issue is leakage of configurations via an unsecured API, which can expose valid LDAP credentials to anyone with access to the configurations API. This creates a risk of unauthorized a...
Getting to Know Cybersecurity Awareness Month Champion: Imperva
As a cybersecurity industry leader, it is both our responsibility and our pleasure to work with the National Cyber Security Alliance NCSA and the Cybersecurity and Infrastructure Agency CISA of the U.S. Department of Homeland Security as a 2021 Cybersecurity Awareness Month Champion and to join...
api.manheim.com Cross Site Scripting vulnerability OBB-2150780
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
A7: Cross-Site Scripting (XSS) — Top 10 OWASP 2017
A7: Cross-Site Scripting XSS 💻 — Top 10 OWASP 2017 Introduction XSS is one of my favourite vulnerability types because of the depth and complexity. It all seems so super simple but when you really get down to the core of XSS there is a world of wonder to explore. Besides the different types of XS...
Millions impacted as payment API vulnerabilities exposing transaction keys
By Deeba Ahmed Millions of users could have exposed their private, payment data due to API security vulnerabilities discovered in several applications. This is a post from HackRead.com Read the original post: Millions impacted as payment API vulnerabilities exposing transaction keys...
Imperva An Eight-Time Magic Quadrant Leader for Web Application and API Protection
2021 has seen a lot of change. Billionaires now go where only governments and Red Bull gimmicks could go before. The 2020 Olympics didn’t take place in 2020. Tom Brady won his 7th Super Bowl for a completely new franchise those of you in the US get this reference. Similar change in application...
Bring Your APIs Out of the Shadows to Protect Your Business
Pankaj Gupta, Senior Director, Citrix APIs are immensely more complex to secure. What was previously one request to one server has become dozens or hundreds of requests to dozens or hundreds of entities. In the past, you defended one large application with a single front door. Now you must defend...
A5: Broken Access Control ❗️ — Top 10 OWASP 2017
A5: Broken Access Control ❗️ — Top 10 OWASP 2017 Introduction A5:Broken Access Control What is access control Access control as the name implies is there to grant or restrict rights to certain users on the application. If the access control is implemented the right way a regular user should not be...
Wallarm API Firewall outperforms Nginx in a production environment
Wallarm API Firewall is a free light-weighted API Firewall that protects your API endpoints in cloud-native environments with API schema validation. Wallarm API Firewall relies on a positive security model allowing calls that match a predefined API specification, while rejecting everything else...
A2: Broken Authentication ❗️ — Top 10 OWASP 2017
A2: Broken Authentication ❗️ — Top 10 OWASP 2017 Introduction When issues arise within the authentication of a program, there are most likely a wide range of dire implications. An example we can discuss is when there is a weak password policy which allows for easily guessable or brute forceable...
UPchieve: No Rate Limiting on /reset-password-request/ endpoint
Summary: Description Hi there ! I noticed when we hit the /reset-password-request/ endpoint too many times via some proxy for e.g:- Burp there is no rate limit on that endpoint and you can spam the email with 100’s of requests and resend even more password reset emails to the users as there is no...
Insufficient Logging Monitoring☝️ — What you need to know
Insufficient Logging Monitoring☝️ — What you need to know Introduction API10:2019 Insufficient Logging & Monitoring What is Insufficient Logging & Monitoring? The title already says a lot but this vulnerability is a bit more complex than it was at first sight, of course the API is vulnerable if it...
Improper Assets Management☝️ — What you need to know
Improper Assets Management☝️ — What you need to know Introduction API9:2019 Improper Assets Management What is Improper Assets Management? We should always wonder for every API if all the current endpoint should even be available and if we maybe can’t do with only allowing the API to communicate...
API8: Injection☝️ — What you need to know
API8: Injection☝️ — What you need to know Introduction API8:2019 Injection What is Injection? API’s with the following properties are open to injection flaws: When we don’t sanitize the input from the front-end we are opening ourselves to a world of problems, this would allow the user to input...
Security Misconfiguration☝️ — What you need to know
Security Misconfiguration☝️ — What you need to know Introduction API7:2019 Security Misconfiguration What is Security Misconfiguration? There are several factors that might indicate a Security Misconfiguration. We should be very careful with handling configurations because if the correct security...
Mass Assignment❗️ — What you need to know
Mass Assignment❗️ — What you need to know Introduction API6:2019 Mass Assignment What is Mass Assignment? Applications these days often rely an objects For example user, product, … and these objects have properties for example product.stock. As a user, we have the authorization to edit and view...
Excessive Data Exposure☝️ — What you need to know
Excessive Data Exposure☝️ — What you need to know Introduction API3:Excessive Data Exposure What is Excessive Data Exposure? An API is only supposed to return the required data to the front-end clients but sometimes teams will make a mistake or take the easy route and implement APIs that return al...
Code injection
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted...
The top 3 OWASP risks to the financial services sector in 2021 and how to mitigate them
The Open Web Application Security Project OWASP is a non-profit organization that helps security experts protect web applications from cyber attacks. OWASP counts 32,000 volunteers worldwide who perform security assessments and conduct research on cybersecurity threats about which the larger...