CVE Program’s Post

Dynamic Code Analysis (DCA) using OWASP ZAP Fuzz testing can be either black box or white box and generally is used to target specific features of a program rather than the overall program. For instance, you may have a program that parses a configuration file upon start-up and then goes on to do something else, like run a web server. You would generate a fuzz test for the code that handles the configuration file to see if the program will crash if an unexpected configuration file is presented. Fuzz testing sometimes reveals security flaws that at a minimum could be denial-of-service flaws, and at worst could cause memory corruption issues and lead to arbitrary code execution and privilege escalation. #cybersecurityawareness #cyberdefense

The ability to trigger XPath queries with user-supplied information introduces the risk of XPath injection #attacks. Read on to explore how these attacks work and discover how to keep your XPath queries secure, from Trend Micro: https://bit.ly/3qT7pHP

The ability to trigger XPath queries with user-supplied information introduces the risk of XPath injection #attacks. Read on to explore how these attacks work and discover how to keep your XPath queries secure, from Trend Micro: https://bit.ly/3qT7pHP

Newer frameworks tend to have more secure defaults than older ones. A lot of the lower hanging fruit of vulnerabilities are being caught. From a UI perspective, this means things like cross site scripting are a lot harder to execute. Not impossible. But harder. From a backend, things like ORMs are making it easier to hide database interactions significantly limiting classes of vulnerabilities like SQLi. Again, not totally eliminating but impacting it none the less. It will be curious to see how mature frameworks handle low hanging fruit when it comes LLMs. Will they be able to help developers protect against Prompt Injection? Or others on the OWASP LLM Top 10? While developer awareness is important, having frameworks which make it harder to implement insecure code stil is one of the best ways to prevent vulnerabilities. #appsecurity #informationsecurity #securecoding

The ability to trigger XPath queries with user-supplied information introduces the risk of XPath injection #attacks. Read on to explore how these attacks work and discover how to keep your XPath queries secure, from Trend Micro: https://bit.ly/3qT7pHP

The ability to trigger XPath queries with user-supplied information introduces the risk of XPath injection #attacks. Read on to explore how these attacks work and discover how to keep your XPath queries secure, from Trend Micro: https://bit.ly/3qT7pHP