Category: PortSwigger

Prototype pollution project yields another Parse Server RCE
28
Dec
2022

Prototype pollution project yields another Parse Server RCE

Adam Bannister 11 November 2022 at 15:37 UTC Updated: 02 December 2022 at 11:49 UTC Bug emerges from ambition to…

rrr
28
Dec
2022

All Day DevOps: Third of Log4j downloads still pull vulnerable version despite threat of supply chain attacks

Adam Bannister 14 November 2022 at 16:16 UTC Updated: 24 November 2022 at 12:50 UTC AppSec engineer keynote says Log4j…

Mastodon users vulnerable to password-stealing attacks
28
Dec
2022

Mastodon users vulnerable to password-stealing attacks

Jessica Haworth 15 November 2022 at 15:39 UTC Updated: 15 November 2022 at 15:47 UTC Patched bug could have leaked…

Vulnerabilities in Zendesk Explore, including a SQL injection flaw, posed a severe risk to enterprise users of the popular CRM platform
28
Dec
2022

Zendesk Explore flaws opened the door to account pillage

John Leyden 15 November 2022 at 16:10 UTC Updated: 16 November 2022 at 11:18 UTC Patched SQLi and logical access…

F5 fixes high severity RCE bug in BIG-IP, BIG-IQ devices
28
Dec
2022

F5 fixes high severity RCE bug in BIG-IP, BIG-IQ devices

Adam Bannister 16 November 2022 at 15:02 UTC Updated: 16 November 2022 at 15:06 UTC Widespread exploitation deemed ‘unlikely’ given…

Google Roulette: Developer console trick can trigger XSS in Chromium browsers
28
Dec
2022

Google Roulette: Developer console trick can trigger XSS in Chromium browsers

Ben Dickson 17 November 2022 at 13:16 UTC Updated: 17 November 2022 at 14:10 UTC A case study on the…

Bug bounty platform HackerOne has overhauled its policy guidelines to enhance legal protections for ethical hackers acting in good faith
28
Dec
2022

HackerOne encourages customers to adopt standard policy to protect hackers from legal problems

John Leyden 17 November 2022 at 15:27 UTC Updated: 28 November 2022 at 14:59 UTC ‘Short, broad, easily-understood safe harbor…

Ibexa DXP patched for GraphQL password hash leak vulnerability
27
Dec
2022

Ibexa DXP patched for GraphQL password hash leak vulnerability

Organizations advised to mandate password resets out of caution Norwegian software firm Ibexa is urging users to apply a new…

A security researcher warns that many Mastodon instances are vulnerable because of missconfiguration problems
27
Dec
2022

Mastodon vulnerable to multiple system configuration problems

John Leyden 22 November 2022 at 15:23 UTC Updated: 23 November 2022 at 10:47 UTC The whole toot Multiple instances…

Vulnerability in AWS AppSync allowed unauthorized access to cloud resources
27
Dec
2022

Vulnerability in AWS AppSync allowed unauthorized access to cloud resources

Ben Dickson 25 November 2022 at 10:22 UTC Updated: 25 November 2022 at 11:17 UTC Attackers could gain full control…

ConnectWise closes XSS vector for remote hijack scams
27
Dec
2022

ConnectWise closes XSS vector for remote hijack scams

Researchers also applaud abandonment of customization feature abused by scammers A cross-site scripting (XSS) vulnerability in ConnectWise Control, the remote…

How to be a pentester
27
Dec
2022

How to become a penetration tester: Part 1 – your path into offensive security testing

Fancy a career in what one practitioner described as the ‘best job in the world’? Read on to find out…