Web Security

A significant vulnerability was detected in IBM QRadar Suite Software and Cloud Pak for Security, allowing attackers to execute arbitrary JavaScript code. An attacker can insert harmful executable scripts into the code of a reliable program or website via stored...

Multiple vulnerabilities have been identified in PHP that are associated with Command Injection, Cookie Bypass, Account takeover, and Denial of Service. The CVEs for these vulnerabilities have been given as CVE-2024-1874, CVE-2024-2756, CVE-2024-3096, and CVE-2024-2757. The severity of these vulnerabilities...

ZAP is a free and open-source web application security scanner. It is designed to be utilized by expert penetration testers as well as individuals who are new to application security.  It has received Flagship status and has been one of...

Trustwave's open-source Web Application Firewall (WAF) engine, ModSecurity, faces DoS risk due to four transformation actions vulnerability. Cybersecurity researchers at Trustwave identified this flaw and alerted the ModSecurity team about their detection. The vulnerability was tracked as CVE-2023-38285. However, the security...

A brand-new release of Burp Suite 2023.6, tailored for both Professional and Community users, has been rolled out recently by PortSwigger. This new Burp Suite 2023.6 comes with a multitude of advancements and several bug fixes. Renowned for its informal...

Patchstack security researchers recently warned that 'Advanced Custom Fields' and 'Advanced Custom Fields Pro' WordPress plugins are at risk of cross-site scripting attacks (XSS).  These WP plugins, installed on millions of websites, may be vulnerable to security breaches. The 'Advanced Custom...

Protecting employees from harmful content was a far more straightforward task once upon a time. COVID-19 changed all of that in an instant. The new hybrid work model has forced IT professionals to rethink their security strategy game plans....

The Python Package Index (PyPI) has been found to contain 29 potentially malicious packages. In most of these cases, you will find that the obfuscated code drops an info-stealer called "W4SP" on infected machines. Others take advantage of malware that...

A new version of Burp Suite (Burp Suite 2021.12.1) with several new bug fixes and features has been released recently by the PortSwigger for Professional and Community users. For web application pentesters, the Burp Suite is a complete set of...

All the major modern web browsers are vulnerable to 14 new types of 'XS-Leak' cross-site leak attacks that have been detected recently by the IT security analysts of the Ruhr-Universität Bochum (RUB) and the Niederrhein University of Applied Sciences. Among...