AppCheck Security Blog

Broken Access Control

There are many different scenarios in which access control may be broken (which we look into in more detail within) but in general an access control failure is any misconfiguration or flaw within the application such that records or resources are not properly protected as designed in terms of their CIA requirements.

read more

Broken Access Control

There are many different scenarios in which access control may be broken (which we look into in more detail within) but in general an access control failure is any misconfiguration or flaw within the application such that records or resources are not properly protected as designed in terms of their CIA requirements.

Read more

Zero Day Vulnerabilities Explained

A “zero day” is a loose term for a recently discovered vulnerability and often associated exploit that overturns the above model, i.e. where a vulnerability has been uncovered but rather than being reported to the vendor is being actively exploited (or attempting to be exploited) by malicious parties - before a patch is released and/or implemented – and often before a vendor or its customers are even aware that the vulnerability in question exists.

Read more

Web Application Security Seminar - Manchester 25th March

A Practical View of the Most Common Threats Facing Web Apps Today

Read more

Reflecting on AppCheck: Stephen Gierke

We have taken on lots of new starters at AppCheck across all departments as we continue to enjoy a period of expansion. We sit down with Stephen Gierke, one of our Account Managers, and ask him about what it's like to work for AppCheck.

Read more

How to choose your DAST Tool

There are a few things you should look for in a DAST tool, some that are universally recommended, and some the utility of which may depend on your organisation and its unique operating environment. Some of the features that AppCheck believes are most important to be included in your new DAST tool are outlined in this article.

Read more

Umbraco ApplicationURL Overwrite & Persistent Password Reset Poison (CVE-2022-22690 & CVE-2022-22691)

Read more

A Christmas Poem - from AppCheck

Our technical team was feeling extremely festive...so we asked them to write a poem

Read more

Apache Log4j 2 Vulnerability (CVE-2021-44228)

A remote code execution vulnerability (CVE-2021-44228) is affecting multiple versions of the Apache Log4j 2 library.

Read more

Webinar: All I Want For Christmas Is Auth!

This webinar hopes to build up an understanding of authentication vulnerabilities, working from the most basic to more intricate scenarios, sparing no detail whilst remaining accessible to non-technical audiences. Straight from the stage of Digital Transformation Expo, this webinar has received some excellent feedback and is not one to be missed.

Read more

DNS Rebinding Attacks

A successful exploit of a DNS rebinding attack turns a victim’s browser into a proxy for attacking screened devices on the user’s private network, which are not exposed to the public internet. Rather than being a “standalone” vulnerability, it is typically used to enable further, onward attacks against devices that an individual or organisation may believe are inaccessible to attackers. DNS rebinding attacks aren’t as well known of or understood by organisations in the same way as household-name exploits such as “XSS”, and so many organisations may not have explicit protection measures in place.

Read more