AppCheck Security Blog
Featured post
Critical Microsoft Web Services (IIS) Flaw Patched (MS15-034)
/ Posted April 15, 2015
Microsoft has released a patch for a critical remote code execution vulnerability in the Windows HTTP Stack for all supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2.
read moreFilter by:
Critical Microsoft Web Services (IIS) Flaw Patched (MS15-034)
Security Alerts / Posted April 15, 2015
Microsoft has released a patch for a critical remote code execution vulnerability in the Windows HTTP Stack for all supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2.
Read moreAppCheck NG Acknowledged by Microsoft, EBay, AT&T and Adobe
News Product Research / Posted March 04, 2015
The Appcheck Web Application scanner is developed in conjunction with a team of around 20 experienced penetration testers and as such deploys the very latest techniques in vulnerability detection from the front lines. Included in those techniques is our ability to detect DOM Based Cross Site Scripting vulnerabilities using a combination of static and run-time analysis of JavaScript and Flash content. Unlike most SaaS vulnerability scanners, AppCheck NG deploys both lexical and browser based analysis of each assessed application component to ensure modern JavaScript heavy and Flash based applications are fully explored for vulnerabilities. This technology allows AppCheck to detect security flaws in components other scanners will fail to detect.
Read moreSecurity Flaw Fixed in Popular Joomla Extension VirtueMart (CVE-2015-2193)
Research Security Alerts / Posted March 03, 2015
On the 10th of February 2015 Appcheck reported several security flaws in the popular VirtueMart eCommerce extension for Joomla (Version 3.0.2). A fix has since been made available via http://virtuemart.net/ although no official announcement was released by the vendor.
Read moreAppCheck Updated to Detect CVE-2015-0235 (a.k.a. GHOST)
Product Security Alerts / Posted January 09, 2015
The “GHOST” vulnerability is a security flaw within a key component of the Linux Operating System. The affected component “gethostbyname” is found in the Linux GNU C Library that is used by all Linux programs. If an attacker can pass a specially crafted hostname to the affected function it may be possible to execute malicious code on the system.
Read moreSafeNet SAS OWA Agent Directory Traversal Vulnerability
Research Security Alerts / Posted November 28, 2014
On the 18th August, 2014, AppCheck reported a Directory Traversal Vulnerability in the SafeNet SAS Outlook Web Access Agent that, without requiring any user authentication, allows a remote attacker to gain access to any file located on the remote server’s local hard drives.
Read moreDrupal 7 SQL Injection – Use AppCheck NG to Discover if You Are Affected
Product Security Alerts / Posted October 31, 2014
Drupal is a popular open source content management system (CMS). The CMS platform is used by hundreds of thousands of organisations globally and has one of the largest user communities.
On 15th October 2014, a pre-authentication SQL injection vulnerability (CVE-2014-3704) was disclosed after a code audit of Drupal extensions. The vulnerability was found in the way Drupal handles prepared statements meaning a malicious user can inject arbitrary SQL queries and control the Drupal installation.
Read moreUnpatched Vulnerabilities in Magento E-Commerce Platform
Research Security Alerts / Posted October 21, 2014
On April 8th 2014, AppCheck reported several Cross Site Scripting Vulnerabilities in the Magento e-commerce platform via the eBay bug bounty program. eBay responded to inform us that the vulnerabilities had already been reported.
However, since more than 6 months have passed and no fix is yet available, This advisory is intended to inform Magento administrators of the vulnerability so that action can be taken to mitigate the flaw.
Read moreShell Shock Vulnerability – Use AppCheck NG to Discover if You Are Affected
Product Security Alerts / Posted September 25, 2014
On the 24th September 2014, a remote code execution vulnerability in bash (CVE-2014-6271) was made public after its discovery by Stephane Chazelas. The flaw, dubbed “Shell Shock” has been given the highest CVSS impact and exploitability rating of 10; and affects all versions of bash between 1.14.0 and 4.3, having existed in bash for 22 years. The flaw affects any operating system and application that utilises the bash shell, including Linux, MacOSX, and Cygwin environments on Windows.
Read more50,000 Websites Hacked Through Critical WordPress Vulnerability
News Security Alerts / Posted July 26, 2014
Over 50,000 websites have been compromised within the first three weeks following the disclosure of a critical vulnerability in the MailPoet plugin (formerly known as Wysija Newsletter) for WordPress.
Read moreTime for Better Web App Security as SQL & XSS Threats Surge
News Product / Posted July 16, 2014
A recent report revealed a 32% increase in cross-site scripting (XSS) and SQL injection attacks on the web-facing and cloud applications that carry sensitive information about organisations and their customers.
Read more