Exploit drops for remote code execution bug in Control Web Panel
Vendor patched the vulnerability in October after a red team alert A pre-authentication remote code execution (RCE) exploit has landed for popular web hosting platform…
Category: PortSwigger
Tesla tackles CORS misconfigurations that left internal networks vulnerable
Typosquatting ploy successfully bypassed firewalls of multiple organizations Tesla is one of several organizations to remedy cross-origin resource sharing (CORS) misconfigurations after security researchers proved…
Devs urged to rotate secrets after CircleCI suffers security breach
DevOps platform advises customers to revoke API tokens Developers are being urged to rotate secrets and API tokens following the discovery of a breach at…
Car companies massively exposed to web vulnerabilities
Grand hack auto The web applications and APIs of major car manufacturers, telematics (vehicle tracking and logging technology) vendors, and fleet operators were riddled with…
Tell us what you think: The Daily Swig reader survey 2023
Have your say to be in with the chance to win Burp Suite swag… The Daily Swig, the brainchild of PortSwigger, the makers of Burp…
Security done right – infosec wins of 2022
The toasts, triumphs, and biggest security wins of the year As 2022 draws to a close, The Daily Swig is revisiting some of the year’s…
Stupid security 2022 – this year’s infosec fails
Epic web security fails and salutary lessons from another inevitably eventful year in infosec As 2022 draws to a close, The Daily Swig is revisiting…
Passport-SAML auth bypass triggers fix of critical, upstream XMLDOM bug
Adam Bannister 08 November 2022 at 16:33 UTC Updated: 25 November 2022 at 10:37 UTC Rapid remedy follows reawakening of long-dormant bug threat A critical…
CSS injection flaw patched in Acronis cloud management console
CSRF attacks could be triggered to access and exfiltrate information A security researcher has disclosed a CSS injection flaw in Acronis software which could be…
Google Pixel screen-lock hack earns researcher $70k
John Leyden 10 November 2022 at 16:14 UTC Updated: 11 November 2022 at 11:23 UTC Android security pwned by PUK reset trick A security researcher…
CSRF in Plesk API enabled server takeover
Ben Dickson 11 November 2022 at 11:31 UTC Updated: 11 November 2022 at 16:51 UTC Bugs in programming interfaces of web hosting admin tool patched…
Prototype pollution project yields another Parse Server RCE
Adam Bannister 11 November 2022 at 15:37 UTC Updated: 02 December 2022 at 11:49 UTC Bug emerges from ambition to find ‘end-to-end exploits beyond DoS’…