Arctic Wolf’s Post

Tracked as CVE-2023-22527 (CVSS score: 10.0), the vulnerability impacts out-of-date versions of the software, allowing unauthenticated attackers to achieve remote code execution on susceptible installations. https://lnkd.in/gv8_EBRE

This task focuses on exploring a common yet critical web vulnerability known as Insecure Direct Object References (IDOR), which falls under the broader category of Broken Access Control. IDOR occurs when an application exposes internal implementation objects, such as files or database records ....

The fact that there are this many system's still vulnerable to this attack (2.8%) and 32% of analysed applications using a library version that went EOL 8 years ago is terrifying. Newer applications that have modern CI/CD pipelines and automated test suites can make responding to these sorts of crises easy so I would not be surprised if these were older applications. I wonder what the threshold would be such that the cost of retro fitting legacy services with this agility outweighs the cost of running vulnerable software.

🔊Noisy alerts, hidden risks and mysterious upgrades- SCA tools can be a real headache, huh? Using program analysis at the time of build, Endor Labs can see exactly what is in your 3rd-party dependencies and how they interact with your application code. We help you: ✅ Create an accurate inventory of your open source dependencies. ✅ Correlate those dependencies with a reliable vulnerability database. ✅ See all the risk, from vulnerabilities to unmaintained packages, that could potentially threaten your application. Want to dive deeper? Check out our latest blog! 👇 https://hubs.ly/Q02M7BJf0 #AppSec #SCA

ANONYMITY TOOLS 🔰 I2P – Fully-encrypted private network layer 🔰 Nipe – Script to make Tor your default gateway 🔰 OnionScan – Discover vulnerabilities available through 🔰 Onion-operated services 🔰 Tor – Onion-routed overlay network What Every Browser Knows About You – Test your own Web browser’s configuration

A critical unpatched vulnerability (CVE-2023-49606) in #Tinyproxy has the potential to result in remote code execution. More than half of the 90,000+ exposed hosts are at risk of exploitation Details: https://lnkd.in/d_bi5QcF CVSS 9.8/10 - update ASAP when fixes are available.

FreePBX 16 Remote Code Execution: FreePBX suffers from a remote code execution vulnerability. Versions 14, 15, and 16 are all affected.

Successfully completed the HTTP in Details section on TryHackMe, unraveling the intricacies of web communication and mastering the nuances of Hypertext Transfer Protocol. Ready to apply this knowledge to enhance web security skills! 💻🚀 #TryHackMe #WebSecurity #HTTPinDetails

Critical Unauthenticated Remote Code Execution Found in Backup Migration Plugin https://lnkd.in/dCtdAje9