Exploitation of this bug can allow attackers to gain access to backend servers. HAProxy, a widely used open source load balancer and reverse proxy, has addressed a critical vulnerability that permitted attackers to execute HTTP request smuggling attacks. Through the submission of specially crafted HTTP requests, an attacker could potentially sidestep HAProxy’s protective filters, allowing…
Exploitation of this vulnerability could allow attackers to gain access to backend servers. HAProxy, a widely used open-source load balancer and reverse proxy, has released a fix for a vulnerability that could potentially allow attackers to carry out HTTP request smuggling attacks. By sending a carefully crafted HTTP request, attackers could circumvent HAProxy’s filters and…
API security presents a valuable entry point into a career in penetration testing, according to an expert in the field. INTERVIEW Securing web APIs requires a specialized approach rather than relying on traditional web application security, as standard tests often overlook prevalent vulnerabilities. This perspective is shared by API security specialist Corey J Ball, who…
John Leyden 22 February 2023 at 14:23 UTC A fix has been issued for a critical vulnerability affecting several technologies. A significant security flaw within a popular anti-malware scanner presents a serious threat to various products from Cisco, a leading networking company. The identified vulnerability in the ClamAV scanning library (known as CVE-2023-20032) poses a…
John Leyden 22 February 2023 at 14:23 UTC A patch has been released addressing a significant vulnerability that could endanger several technologies. A security vulnerability in a bundled anti-malware scanning product has created a serious risk for various Cisco products. Specifically, a vulnerability in the ClamAV scanning library (identified as CVE-2023-20032) poses a significant security…
Ben Dickson27 February 2023 at 11:50 UTC Recent vulnerabilities have exposed flaws in protections against cross-site request forgery (CSRF). An alarming issue in the Chromium project has been identified, allowing unauthorized users to bypass critical security features designed to protect sensitive cookies on Android devices. The SameSite attribute allows developers to restrict cookie access, thus…
Jessica Haworth-Elsayed 24 February 2023 at 13:09 UTC Updated: 27 February 2023 at 15:32 UTC In this bi-weekly summary, we delve into recent vulnerabilities in application security, innovative hacking methodologies, and significant updates from the cybersecurity landscape. Recently, Twitter encountered backlash as its CEO Elon Musk declared that SMS-based two-factor authentication (2FA) will now be…
Ben Dickson 27 February 2023 at 11:50 UTC Recent findings reveal vulnerabilities in protections against cross-site request forgery (CSRF), which may be exploited by malicious entities. A critical vulnerability in the Chromium platform might allow attackers to sidestep a vital security feature designed to protect sensitive cookies in Android browsers. The SameSite attribute is implemented…
The second installment of our series on password managers delves into enterprise-level solutions designed to manage API tokens, login credentials, and much more. Today’s enterprises manage numerous servers, applications, services, APIs, and containers. To protect these assets, they require robust tools to handle sensitive information, including passwords, encryption keys, SSH keys, API tokens, and certificates….
Charlie Osborne28 February 2023 at 14:15 UTC Updated: 28 February 2023 at 14:51 UTC A researcher has shown alarming vulnerabilities that allowed access to the personal identifiable information (PII) of approximately 185 million Indian citizens, enabling the creation of counterfeit driving licenses. An important revelation came from student and cybersecurity researcher Robin Justin, who disclosed…
