565 matches found
Slack GitHub Account Hacked via Stolen Employee API Token
On December 29, 2022, Slack was alerted to suspicious activity on their GitHub account. Upon investigation, the company discovered that a limited number of employee tokens had been stolen and misused to gain access to an externally hosted repository. The threat actor had also downloaded private...
What ChatGPT know about API Security?
There is no doubt that you heard about and seen the latest OpenAIs brilliant called ChatGPT. It can write poems, speak many languages, answer questions, play chess, make code and impress everyone. In this post, we show a few more of how this AI model is good in cybersecurity, in particular in API...
Can ChatGPT be used to attack your APIs? | API Security Newsletter
The winter solstice is fast approaching, along with the end-of-year holidays - before we know it, itll be 2023 already! And with the fall behind us, our hive has been busy putting the finishing touches on many new and improved capabilities – such as weak JWT detection, API Abuse Prevention, API...
Q3-2022 API ThreatStats™ Report
The latest quarterly review and analysis of API vulnerabilities and exploits is in. Our initial take had us thinking it was smooth sailing for the state of API vulnerabilities in Q3—or was it just a lull in the storm? As it turns out, it’s neither. Read on to learn more about Wallarm’s analysis o...
Azure CLI Code Injection CVE-2022-39327 hits 9.8/10 CVSS score
The most recent Azure CLI Code Injection vulnerability is a rare and dangerous case. It’s not often that the most popular cloud platform client is vulnerable to such critical issues as code injection. Regardless overall high risk of injections by OWASP Top 10 and OWASP API Security Top 10, code...
Wallarm at API World and KubeCon 2022 this week
This is a busy week for the whole Wallarm team as we are sponsoring two big conferences at the very same time. API World 2022 Wallarm will be at API World in San Jose starting today. Stop by booth 209 to chat with our apisecurity experts about everything APIs, and check out a demo of Wallarm WAAP...
Evolution of API Security – A Practical Guide to Addressing API Threats in 2023
The kind of API security scenarios we witnessed today were never like this from the beginning of time. It has gone to extra lengths to become responsive and productive as it’s now. How was it in the beginning? What changes has it faced? What more can we expect in the future? If this is what bothe...
New text2shell RCE vulnerability in Apache Common Texts CVE-2022-42889
Yet another RCE with a CVSS score of 9.8 out of 10 was disclosed a few hours ago. This issue looks like the same Log4shell and it seems even more dangerous since Common Texts are used more broadly. The Apache Foundation published a vulnerability in the Apache Commons Text project code and publish...
8 KB is not enough: why WAFs can’t protect APIs
WAFs were a top-notch security instrument a decade ago, but now they are not. They fail to protect APIs. Meanwhile, the number of API-specific vulnerabilities grew more than twofold in 2022. According to a report by Wallarm, many such vulnerabilities have critical severity, and 33% are immediatel...
How Uber was hacked in 2022
What happened? The first information about the incident was issued yesterday, September 15th, 2022. We know that a hacker called “Tea Pot” successfully accessed Uber infrastructure and critical cloud services such as AWS, Slack, Google Workspace, and others. Most likely, Uber understood what had...
What’s most important for a CISO in API security?
As threats to networks and systems have changed, so have CISOs’ priorities. API security has grown more important with everything as a service and in the cloud. Todays CISOs must ensure they have a plan for protecting APIs. To learn what’s most crucial when protecting APIs, we surveyed CISOs and...
Integrating API Security and WAF into K8s Kong API Gateway
Article by Jiju Jacob, Director of Engineering at Revenera This is an update of Mr. Jacobs’ 05/23 post in his Medium blog. He is a Director of Engineering at Revenera. Revenera, born as InstallShield and now a Flexera company, helps software and technology companies use open source solutions more...
What are JWT Injections, and Why do You Need to Know About Them
JSON Web Tokens JWTs for short are the new standard for transmitting identity information in the digital age. JWTs are JSON objects that act as an identifier for your user or application. They’re used to authenticate users and securely transmit secrets as part of an API, application, or service...
Wallarm at Black Hat USA 2022
Black Hat USA is celebrating its 25th anniversary, and Wallarm will be on hand for the festivities. If you’re headed to Vegas this year, we invite you to meet our crew and talk about API security. Tuesday 08/09 – Pre-Event Evening Party Join us on Tuesday 08/09 evening at the Emerging Technology...
GitLab Security Issues: Six Months of Vulnerabilities
Have you ever thought the most popular CI/CD platform – GitLab – may have security issues? In fact, it is inevitable with such a massive infrastructure. Don’t worry! The platform is still reasonably secure: it scores well over 700 on BitSight, monitors alerts in real-time, and addresses them...
API Vulnerabilities Jump Up 3.7x in Q2-2022
Since the beginning of 2022, the Wallarm security research team has been analyzing API vulnerabilities and exploits, and releasing quarterly reports. The Q1 report got a lot of attention and positive feedback from the cybersecurity community, as well as a few valuable ideas and suggestions. We...
Wallarm extends AWS API security with the official Terraform module
Wallarm API Security solution is now available in AWS as an official Terraform module, with a full feature set including autoscaling groups, API Gateway connector, mirroring, and agentless out-of-band deployments. To address modern cloud-native threats, API security vendor Wallarm released extend...
Open-Source API Firewall Unveils New Feature: Default Deny Lists for Compromised API Tokens and Cookies
Discovering and securing any API is one of the most difficult challenges for developers. The API security landscape is constantly evolving, with new threats and vulnerabilities emerging at a rapid pace. Since commercial API security solutions can be expensive for some organizations especially...
10 Years Journey into API Security Vulnerabilities with Ivan, the CEO of Wallarm
Ivan Novikov, CEO at Wallarm, is an API security expert, bug hunter, security researcher, and blackhat speaker with 24 years of experience in the cybersecurity field. He spent decades in this industry and witnessed exploits as well as growth. Read ahead to understand Ivan’s API Security journey a...
OWASP Top-10 2022: Forecast Based on Statistics
For tech innovators and security experts, what OWASP Top-10 says or predicts is much attention-worthy as this globally recognized document guide about the hidden and damage-causing security threats. As the year 2022 has begun, the people willing to learn about the latest security trends and...
Update on Spring Data MongoDB SpEL Expression Injection Vulnerability (CVE-2022-22980)
Background On June 20, 2022 Spring released Spring Data MongoDB 3.4.1 and 3.3.5 to address a critical CVE report: CVE-2022-22980: Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods. This vulnerability was originally reported on June 13, 2022...
Update on the Confluence 0-day vulnerability (CVE-2022-26134)
We want to share this update regarding the critical Confluence 0-day vulnerability CVE-2022-26134. On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Data Center applications, highlighting a critical severity unauthenticated remote code execution RCE...
RSAC 2022 – The Year of API Security
Not only is RSAC back in person, but API security is coming to the forefront. Wallarm, the G2 leader in Application Security, is thrilled to be back at RSAC where we will show off all of our new API Security capabilities and tools since we last saw everyone in 2020. Highlights of What’s New:...
Three new API exploits causes GitLab data privacy and availability issues
On May 10, 2022, and May 11, 2022, CVE-2022-1352 CVE-2021-1431, and CVE-2022-1545 were fixed and published on Gitlab-ORG public repository. There are no technical details or exploits yet, but according to the high-level description and titles, they gonna be critical Gitlab API vulnerabilities tha...
Two critical security flaws found in Nginx-Ingress controller
Ingress controllers allow users to configure an HTTP load balancer for applications running on Kubernetes. It’s needed to serve those applications to clients outside of the Kubernetes Cluster. It’s also configured with Kubernetes API to deploy objects called Ingress Resources The NGINX Ingress...
CVE-2022-1388: Critical security vulnerabilities in F5 Big-IP allows attackers to execute arbitrary code
On May 5, 2022, MITRE published CVE-2022-1388, an authentication bypass vulnerability in the BIG-IP modules affecting the iControl REST component. The vulnerability was assigned a CVSSv3 score of 9.8 The vulnerability was discovered internally by the F5 security team and there is no evidence of...
OSS API Firewall Unveils new Feature: Blacklist for Compromised API Tokens and Cookies
Discovering and securing any API is one of the most difficult challenges for developers. The API security landscape is constantly evolving, with new threats and vulnerabilities emerging at a rapid pace. Since commercial API security solutions could be really expensive for organizations, its never...
Update on 0-day vulnerabilities in Spring (Spring4Shell and CVE-2022-22963)
Quick update There are two vulnerabilities: one 0-day in Spring Core which is named Spring4Shell very severe, exploited in the wild no CVE yet and another one in Spring Cloud Function less severe, CVE-2022-22963 Wallarm has rolled out the update to detect and mitigate both vulnerabilities No...
Cryptographer – Job Description and How to Become
Introduction Cryptography is perhaps the main instrument for building a secure computerized framework. These professionals assume a major part in building these frameworks. This makes them probably the most generously compensated and profoundly esteemed laborers inside the growing universe of...
Malware Analyst – Job Description and How to Become
Introduction Malware investigation is the review or cycle of deciding the usefulness and possible effect of a given malware like an infection, worm, trojan, rootkit, or secondary passage. Malware or malignant programming is any PC programming planned to hurt the host working framework or to take...
Security Assessor – Job Description and How to Become
Introduction It requires a ton of work to turn into a QSA and keep your affirmation. In truth, there is an enormous rundown of standards to meet to be thought of. What is a Cyber security control assessor? The Security Control Assessor SCA is a cybersecurity personnel that utilizes security testi...
Information Security Consultant – Job Description and How to Become
Introduction As per Centrify, a forerunner in the Privileged Access Management PAM market that forms programming to forestall cyberattacks, the huge ascent of people working from a distance during the COVID-19 pandemic has raised the probability of a digital break. Therefore, network protection h...
Security Software Developer – Job Description and How to Become One
Introduction The cybersecurity industry is daily growing bigger daily and creating numerous roles for anyone to specialize in. One of the eye-catching perks of the industry is the annual pay which varies according to the role. This guide focuses on teaching a security software developer job...
Security Manager Guide – Job Description and How to Become
Introduction This guide discloses how to turn into a security supervisor, as well as the means to take to begin in this productive and intriguing industry. Keep perusing to find about the instructive, and certificate prerequisites for cybersecurity managers in the work environment. Bosses look fo...
Security Architect Guide – Job Description and How to Become
Introduction In the steadily changing field of online protection, companies need thoroughly prepared staff to assist them with staying aware of their developing security needs. Associations that neglect to focus on these web security wind up paying the consequences for it. Things being what they...
Information Security Analyst – Job Description and How to Become
Introduction A security expert is a wide work term that alludes to persons who keep up with the security of PC frameworks and organizations. Let us go through an information security analyst jobs description What is an information security analyst? Huge data breaks at colossal associations have a...
Penetration tester Guide – Job Description and How to Become
What is a penetration tester? In the realm of data security, pentesters are the specialists. The reason, likewise with other PI works out, is to recognize hazards before any potential meddling bosses get an opportunity to set up their framework. Helpless entertainers will endeavor to take advanta...
Cybersecurity Engineer Guide – Job Description and How to Become
Introduction The interest for network security occupations is soaring, but the arrangement is at an incredible insufficient. Experts anticipate a 2021 increment of 3,500,000 empty web-based security occupations all over the planet, as shown by the New York Times. Essentially, there arent sufficie...
Best cyber security jobs in 2022 – Highest paying
Web protection is a worthwhile and quickly extending field that spotlights on shielding organizations from current attacks and guarding their information and frameworks. Specialists in network security distinguish blemishes, give programming and gear answers for diminish hazards, and foster plans...
16 Best DDOS Attack Tools in 2022
What are DDOS attack tools? DDOS attacks are cyber- attacks targeted at rendering certain computers, network systems and servers non-functional. The processes involved in its execution can be however complicated. Attackers have to carry out a long series of actions that involve social engineering...
SSH Host Based Authentication
Introduction Are you an organization that manages or hosts a huge pool of resources on remote locations/servers? Well, host-based authority-validation technique is the most-suited way to manage the access and control rights related to your hardware and applications. Once implemented, this identit...
What is fuzz testing? What is it used to test for?
Fuzz testing, regularly known as fuzzing, is a product testing procedure that incorporates embedding flawed or arbitrary information FUZZ into a product framework to recognize coding issues and security issues. Fuzz testing involves infusing information into a framework utilizing robotized or...
Best IP Stresser Tool
Introduction Testing the restriction of your Web laborer incorporates pushing legitimately greater measures of traffic to it. You can either get delivered traffic or catch as of late experienced traffic and replay it at a higher concurrence than truly happened. There are organizations that can gi...
PCI Penetration Test – Everything You Need to Know
Introduction For any association that cycles, stores or sends charge card information, entrance testing has been a commitment since 2013. That is the point at which the consistence necessities set up by the Payment Card Industry Security Standards Council PCI SSC were refreshed to mirror the...
What Is Local File Inclusion Vulnerability?
Introduction This article clarifies what nearby record consideration LFI weaknesses are, including the way assailants can take advantage of them on weak web applications and what safe coding practices can assist you with forestalling local document incorporation assaults. Record incorporations ar...
What is Code Obfuscation?
Introduction The hazards of hacking and its corresponding disasters have become so precarious that the developers and organizations take utmost care to lessen their occurrence and the impact. Code obfuscation is one such strategic move that, when performed, keeps administered codes away from the...
5 things you must know about Log4Shell
This is the largest vulnerability we have seen in years. 1. You may still be vulnerable even if your project is not based on Java. Many tech stacks are vulnerable because so many tools use the Log4js including infrastructure, dev-tools, and CI/CD products. 2. Log4Shell will be here for a while...
Log4j 0day mitigation update CVE-2021-44228
Wallarm has rolled out the update to detect and mitigate CVE-2021-44228. No additional actions are required from the customers Attempts at exploitation will be automatically blocked in a blocking mode When working in a monitoring mode, consider creating a virtual patch Log4Shell A 0-day exploit i...