AppCheck Security Blog

Shell Shock Vulnerability – Use AppCheck NG to Discover if You Are Affected

On the 24th September 2014, a remote code execution vulnerability in bash (CVE-2014-6271) was made public after its discovery by Stephane Chazelas. The flaw, dubbed “Shell Shock” has been given the highest CVSS impact and exploitability rating of 10; and affects all versions of bash between 1.14.0 and 4.3, having existed in bash for 22 years. The flaw affects any operating system and application that utilises the bash shell, including Linux, MacOSX, and Cygwin environments on Windows.

read more

Shell Shock Vulnerability – Use AppCheck NG to Discover if You Are Affected

On the 24th September 2014, a remote code execution vulnerability in bash (CVE-2014-6271) was made public after its discovery by Stephane Chazelas. The flaw, dubbed “Shell Shock” has been given the highest CVSS impact and exploitability rating of 10; and affects all versions of bash between 1.14.0 and 4.3, having existed in bash for 22 years. The flaw affects any operating system and application that utilises the bash shell, including Linux, MacOSX, and Cygwin environments on Windows.

Read more

50,000 Websites Hacked Through Critical WordPress Vulnerability

Over 50,000 websites have been compromised within the first three weeks following the disclosure of a critical vulnerability in the MailPoet plugin (formerly known as Wysija Newsletter) for WordPress.

Read more

Time for Better Web App Security as SQL & XSS Threats Surge

A recent report revealed a 32% increase in cross-site scripting (XSS) and SQL injection attacks on the web-facing and cloud applications that carry sensitive information about organisations and their customers.

Read more

Apache Struts Vulnerability – Use AppCheck NG to Discover if You Are Affected

Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model–view–controller (MVC) architecture.

On April 24th the Apache Struts project released an advisory for a remote code execution vulnerability affecting all versions of Struts between 2.0.0 and 2.3.16.1. Struts 2.3.16.2 (the latest release) is not vulnerable.

Read more

AppCheck NG Updated to Discover Critical OpenSSL Bug “Heartbleed”

On 7th April 2014 a group of security researchers disclosed a critical security flaw in the popular cryptographic software library OpenSSL.
The Heartbleed Bug allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.
The AppCheck NG Web Application and Infrastructure vulnerability scanner has already been updated with a plugin to detect the flaw.

Read more