Critical IP spoofing bug patched in Cacti
‘Not that hard to execute if attacker has access to a monitoring platform running Cacti’ A dangerous bug in Cacti, the RRDTool frontend and performance/fault…
Category: PortSwigger
Deserialized web security roundup – Fortinet, Citrix bugs; another Uber breach; hacking NFTs at Black Hat
John Leyden 16 December 2022 at 17:43 UTC Updated: 19 December 2022 at 14:19 UTC Your fortnightly rundown of AppSec vulnerabilities, new hacking techniques, and…
Safeurl HTTP library brings SSRF protection to Go applications
Prizes offered to anyone who can bypass the library and capture the flag A new open source library designed to thwart server-side request forgery (SSRF)…
Akamai wrestles with AWS S3 web cache poisoning bug
Definitive solution is ‘non-trivial’ since behavior arises from customers processing non-RFC compliant requests A vulnerability in how Akamai retrieves Amazon Web Services (AWS) S3 resources…
How to become a penetration tester: Part 2 – ‘Mr Hacking’ John Jackson on the virtue of ‘endless curiosity’
Marine Corps engineer-turned offensive security expert offers careers advice and his best and worst experiences John Jackson has been working in cybersecurity for less than…
Password theft bug chain patched in Passwordstate credential manager
Flaws could be combined to grab passwords in cleartext Vulnerabilities in enterprise password manager Passwordstate that could be combined to exfiltrate stored credentials have been…
Zoom Whiteboard patches XSS bug
Ben Dickson 22 December 2022 at 12:00 UTC Updated: 22 December 2022 at 12:03 UTC Video conferencing platform fixes cross-site scripting vulnerability Zoom has patched…
Lean, green coding machine: How sustainable computing drive can reduce attack surfaces
Less is often more when it comes to both infosec and eco-friendly computing practices Reducing the carbon footprint of computing architecture could play a role…
Finding the next Log4j – OpenSSF’s Brian Behlendorf on pivoting to a ‘risk-centred view’ of open source development
Apache pioneer says ‘use at your own risk’ model no longer tenable as OpenSSF ramps up end user engagement The Open Source Security Foundation (OpenSSF)…