Understanding New Image Formats

Akamai Image & Video Manager IVM already supports key modern image types, such as WebP, JPEG 2000, and JPEG XR, but the imaging industry is always evolving and raising the bar on the balance of compression and quality. In addition, creative and development teams are regularly asking about new...

Storefront 3.12 : SSON not working with Storefront and Microsoft Edge based on Chromium

Works with IE and all other browsers exceptMicrosoft Edge based on Chromium...

AVIF has landed

Back in ancient July I released a video that dug into how lossy and lossless image compression works and how to apply that knowledge to compress a set of different images for the web. Well, that's already out of date because AVIF has arrived. Brilliant. AVIF is a new image format derived from the...

Researchers Compromise Netflix Content in Widevine DRM Hack

Researchers have used a proof-of-concept PoC side-channel attack to download an unencrypted raw file for Netflix’ Stranger Things, in a format that’s ready to distribute out to any buyer on the internet. This pirate’s booty is the result of breaking open the widely deployed digital rights...

jenkins: workspace browser allowed accessing files outside the workspace (SECURITY-904)

An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace...

CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2019-04442)

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...

TAC Xenta 511911 - Directory Traversal

TAC Xenta 511911 - Directory Traversal Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure Date: 25.05.2018 Exploit Author: Marek Cybul Vendor Homepage: https://download.schneider-electric.com/files?pFileName=TACXenta911SDS-XENTA911.pdf Version: 5.17 Schneider Electric TAC Xenta 911 and 5...

FAQ: Citrix Insight Services (CIS)

Citrix Endpoint Management, using technology formerly called XenMobile This article contains answers to frequently asked questions aboutCitrix Insight Services formerly known as TaaS. Contents General Citrix Insight Services Plug-ins Security Considerations File Uploading Analysis Feedback Genera...

cloudforms: XSS in self-service UI snapshot feature

A flaw was found in CloudForms in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP Content Securi...

Google to Ditch Public Key Pinning in Chrome

Google said that in an upcoming version of Chrome it will deprecate the browser’s support for HTTP public key pinning. Instead, it will adopt the “safer” more flexible solution of Expect-CT headers. HTTP public key pinning HPKP is a browser security measure that protects against an SSL certificat...

What are Javascript Source Maps?

Its generally a good practice to minify and combine your assets Javascript & CSS when deploying to production. This process reduces the size of your assets and dramatically improves your websites load time. Source maps create a map from these compressed asset files back to the source files. This...

ECMAScript modules in browsers

ES modules are now available in browsers! They're in… Safari 10.1. Chrome 61. Firefox 60. Edge 16. import addTextToBody from './utils.mjs'; addTextToBody'Modules are pretty cool.'; // utils.mjs export function addTextToBodytext const div = document.createElement'div'; div.textContent = text;...

TestingWhiz - Codeless Software Testing Automation Tool

TestingWhiz is a test automation tool for web, database, cloud, mobile and web services/API testing from Cygnet Infotech. It has a codeless architecture based on FAST Automation Engine with 290+ readily available test commands that provide easy, intuitive and fast automation solution without...

Stored XSS in "gallery" application (NC-SA-2016-001)

Due to a recent migration of the Gallery app to the new sharing endpoint a parameter changed from an integer to a string value. This value wasn't sanitized before and was thus now vulnerable to a Cross-Site-Scripting attack.To exploit this vulnerability an authenticated attacker has to share a...

Tasks, microtasks, queues and schedules

When I told my colleague Matt Gaunt I was thinking of writing a piece on microtask queueing and execution within the browser's event loop, he said "I'll be honest with you Jake, I'm not going to read that". Well, I've written it anyway, so we're all going to sit here and enjoy it, ok? Actually, i...

SSL v3 Poodle security vulnerability fix recommendations-vulnerability warning-the black bar safety net

! The use of SSL to protect your website traffic far more than is on the server install an SSL certificate. Era in constant development,with the browser of aging, password strength reduction as well as attackers become more creative, the situation has undergone subtle changes. For early...

[SECURITY] Fedora 20 Update: nodejs-qs-0.6.6-3.fc20

This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior and twice as fast. Used by express, connect and others...

Minimising font downloads

Optimising fonts is pretty difficult for larger sites. There's an easy solution, although only some browsers support it. Translations Français Fonts can be big Really big. They can be anywhere from 70k to many megabytes compressed of course, because why wouldn't you?. You want bold? Well, you jus...

Facebook Password Remover - All-in-one Facebook Login Password Removal Tool

Facebook Password Remover is the free all-in-one tool to quickly remove the stored Facebook Login passwords from your system. This helps you to delete any accidently or otherwise stored Facebook password on any public/shared computers so that your Facebook account remains safe. Currently it...

Server: Multiple XSS

Due to not sanitising all user provided input the below mentioned ownCloud versions are vulnerable against several XSS attack vectors. ownCloud advises browsers to disable inline JavaScript execution due to the used Content-Security-Policy, this vulnerability is therefore likely not exploitable i...