Incapsula Updated Review — New Security Options, Improved Delivery and Reliability

It's been close to five years since we last looked at Incapsula, a security-focused CDN service known for its DDoS mitigation and web application security features. As one would expect, during these five years the company has expanded and improved, introducing lots of new features and even severa...

How to Protect AWS API Gateway with SecureSphere WAF

Serverless architectures are becoming more and more popular, and Amazon’s API Gateway service is a key factor in many serverless deployments on AWS. Currently API Gateway only supports a public CloudFront endpoint, and securing the API Gateway with high-end WAF protection may seem like a difficul...

A Leader for Four Consecutive Years in the Gartner Magic Quadrant for WAFs

Gartner has published their 2017 Magic Quadrant for Web Application Firewalls WAF and Imperva has again been named a WAF leader—now for four consecutive years. Attacks remain same, but infrastructure is changing According to 2017 Verizon Data Breach Investigations Report, web app attacks remain t...

Conversations on Securing Microservices, API Gateways and Containers

Last month, I met James name changed while at AWS Summit in London. As I was managing Imperva's booth, he walked over to me with a query about what we do. A conversation ensued and James described his company for me. They were into financial-legal intermediation between underwriters, insurance...

CVE-2017-9791: Analysis of RCE in the Struts Showcase App in Struts 1 Plugin

On July 7th, a new security vulnerability was published in Apache Struts 2 CVE-2017-9791 S2-0481. Struts 2.3.x users with Struts 1 plugin, which includes the Showcase app, are vulnerable. Once again, this vulnerability enables a Remote Code Execution RCE, which is the most commonly exploited Apac...

Data Anonymization: Motivation and Mechanics

Data is one of the most valuable assets a company has in its possession. And while it may not be listed as a line item on the balance sheet, when a company’s data is breached it can have a very negative impact on the bottom line—in a company’s stock price, reputation and brand. One approach to...

GDPR Readiness – Calculate Your Return on Security Investment (ROSI)

What is the cost of a data breach? Assuming annual revenue of £30M, a single fine could be as much as a whopping £1.2M—the maximum 4%—when the European Union’s General Data Protection Regulation GDPR becomes effective in May 2018. Compare that to a database control cost factor of £750K, the cost ...

Protect Against WannaCry with Deception-Based Ransomware Detection

The WannaCry ransomware attack caught the world off guard—and may have even literally left some crying. The attack infected more than 230,000 computers in 150 countries by encrypting data on networked machines and demanding payments in Bitcoin. According to Malwarebytes researchers, the attack...

New Call to Regulate IoT Security By Design

A Washington, D.C. think tank whose mission is critical infrastructure security has joined the call for lawmakers to consider regulating the security of connected devices. In a report published this week, the Institute for Critical Infrastructure Technology pinned the blame for a rash of Mirai...

Imperva SecureSphere Web Application Firewall Detects Bypass Vulnerabilities

Imperva SecureSphere Web Application Firewall is a WEB application firewall that protects web applications and sensitive data. A detection bypass vulnerability exists in the a parameter of the sqli.asp page in Imperva version 11.5, which can be exploited by attackers to bypass security restrictio...

Imperva 11.5 Detection Bypass Vulnerability

Exploit for asp platform in category web applications Bypass Imperva by confusing HTTP Pollution Normalization Engine Author: Wiswat Aswamenakul Environment: Tested with Imperva Version: 11.5 and Web Backend as IIS + ASP Description: One of technique that attackers use to bypass web application...

Imperva 11.5 Detection Bypass

Bypass Imperva by confusing HTTP Pollution Normalization Engine Author: Wiswat Aswamenakul Environment: Tested with Imperva Version: 11.5 and Web Backend as IIS + ASP Description: One of technique that attackers use to bypass web application firewall is to use HTTP pollution attack. The attack ca...

HTTP2. 0 Protocol is aeration 4 high-risk vulnerabilities can cause server to crash-bug warning-the black bar safety net

! If you think that HTTP2. 0 Protocol than the standard HTTP Hypertext Transfer Protocol more secure, then you're wrong. Researchers spent 4 months in HTTP2. 0 Protocol found 4 vulnerabilities that! Last 2 month, Google put their SPDY project bundled into HTTP2. 0, intended to strengthen the page...

SSL/TLS Suffers ‘Bar Mitzvah Attack’vulnerability detection method and repair recommendations-vulnerability warning-the black bar safety net

0x01 introduction April Fool's Day is coming, and SSL again due to the Bar Mitzvah Attack vulnerability to get everyone to not mind. Held in Singapore's Black Hat Asia Security Conference, the Imperva security Director Itsik Mantin detailed description of how to use the attack principle,the...

CVE-2011-4887

Cross-site scripting XSS vulnerability in the Violations Table in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall WAF 9.0 allows remote attackers to inject arbitrary web script or HTML via the username field...

Cross site scripting

Cross-site scripting XSS vulnerability in the Violations Table in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall WAF 9.0 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2011-4887

Cross-site scripting XSS vulnerability in the Violations Table in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall WAF 9.0 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2011-4887

The CVE-2011-4887 entry covers an XSS vulnerability in the MX Management Server’s management GUI (Violations Table) of Imperva SecureSphere Web Application Firewall 9.0. The issue stems from input handling in the username field, allowing remote attackers to inject arbitrary web script or HTML. Do...

Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities

No description provided by source. Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt =============================== - Advisory - =============================== Tittle: Imperva SecureSphere Operations Manager - Command Execution Post Authentication & Minor issu...

Imperva SecureSphere Web Application Firewall MX 9.5.6 - Blind SQL Injection

No description provided by source. Blind SQL Injection to Imperva SecureSphere Web Application Firewall MX ======================================================================= ADVISORY INFORMATION Title: Blind SQL Injection on Imperva SecureSphere Web Application Firewall MX Discovery date:...