Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Latest News

Snyk

How to secure a REST API?

Jun 27, 2024 By Liran Tal In Snyk
As developers, we often have to work with REST APIs when we integrate with third-party systems or connect between frontend and backend systems at work. APIs, and REST APIs in particular, are a fundamental part of modern web applications, allowing us to create, read, update, and delete data over HTTP. However, as with any technology, they come with their own set of security challenges. Let's break these challenges down and understand how to secure REST API applications.
Read Post
graylog

The exploit prediction scoring system: What it is and how to use it

Jun 27, 2024 By Graylog Security In Graylog
Managing vulnerabilities can feel like the end of the first act of Les Misérables as you sing to yourself, “one day more, another day another vulnerability.” Like Jean Valjean, you attempt to put up barricades to protect your environment from attackers exploiting these security weaknesses. Keeping pace with the number of vulnerabilities and threat actor activities becomes overwhelming, leaving you to feel outnumbered and outmanned.
Read Post
Arctic Wolf

CVE-2024-5805 & CVE-2024-5806: Authentication Bypass Vulnerabilities in Progress MOVEit Transfer and MOVEit Gateway

Jun 26, 2024 By Andres Ramos In Arctic Wolf
On June 25, 2024, Progress disclosed two vulnerabilities affecting MOVEit Transfer and MOVEit Gateway: CVE-2024-5805: A critical severity authentication bypass vulnerability affecting MOVEit Gateway (SFTP module). MOVEit Gateway is a proxy for MOVEit Transfer, designed to securely handle inbound connections when deployed behind a firewall.
Read Post
Tines

How security teams enhance vulnerability management with Tines

Jun 26, 2024 By Dave Herder In Tines
When it comes to vulnerability management, time is critical - every minute a vulnerability goes unaddressed, the risk escalates. To ensure all risks are addressed, security teams need vulnerability management processes that are reliable and efficient, and, crucially, don’t drain their resources. And given that 22% of cybersecurity professionals have admitted to ignoring an alert completely, we can’t afford to rely on the human element alone.
Read Post
Snyk

Polyfill supply chain attack embeds malware in JavaScript CDN assets

Jun 26, 2024 By Liran Tal In Snyk
On June 25, 2024, the Sansec security research and malware team announced that a popular JavaScript polyfill project had been taken over by a foreign actor identified as a Chinese-originated company, embedding malicious code in JavaScript assets fetched from their CDN source at: cdn.polyfill.io. Sansec claims more than 100,000 websites were impacted due to this polyfill attack, including publicly traded companies such as Intuit and others.
Read Post
wallarm

CVE-2024-36680: SQL Injection Vulnerability in Facebook's PrestaShop Module Exposes Thousands of E-commerce Sites to Credit Card Fraud

Jun 26, 2024 By Wallarm In Wallarm
PrestaShop is a free, open-source E-commerce platform launched in 2007. Built with PHP and MySQL, it offers customizable, scalable solutions for online stores. Features include product management, inventory tracking, and payment processing. Supporting multiple languages and currencies, it's ideal for small to medium businesses worldwide. Built by Promokit, the pkFacebook add-on integrates PrestaShop with Facebook, enabling product catalog sync, dynamic ads, and Facebook Shop creation.
Read Post
securitysenses

eSIM Cybersecurity: More Advantages or Drawbacks?

Jun 25, 2024 By SecuritySenses In SecuritySenses
As eSIM technology gets more popular every year and more people turn to it rather than physical SIM cards, what are the benefits? With eSIM technology, the SIM is built into the device, making it more convenient. An eSIM stands for embedded subscriber identity module and is an essential component that allows modern mobile devices to connect to mobile network operator services worldwide. However, I am more concerned about security rather than the features that new innovations bring. This is why I am dedicated to learning what security protocols eSIM uses and how safe embedded SIMs are for users.
Read Post
cyberark

Identity Security: The Keystone of Trust

Jun 25, 2024 By Claudio Neiva In CyberArk
A few weeks ago, my wife asked me why stopping threat actors from impacting our lives is so difficult. In this digital age, the necessity to connect online brings inherent exposure to vulnerabilities. The challenge for you as a security leader lies in reducing the sense of vulnerability by building trust. You need to protect your organization and reassure employees so they can perform their jobs without fear.
Read Post
Snyk

Snyk Code now secures AI builds with support for LLM sources

Jun 25, 2024 By Liqian Lim () In Snyk
As we enter the age of AI, we’ve seen the first wave of AI adoption in software development in the form of coding assistants. Now, we’re seeing the next phase of adoption take place, with organizations leveraging increasingly widely available LLMs to build AI-enabled software. Naturally, as the adoption of LLM platforms like OpenAI and Gemini grows, so does the security risk associated with using them.
Read Post
Snyk

Finding and fixing exposed hardcoded secrets in your GitHub project with Snyk

Jun 25, 2024 By Chandler Mayo In Snyk
Snyk is an excellent tool for spotting project vulnerabilities, including hardcoded secrets. In this blog, we'll show how you can use Snyk to locate hardcoded secrets and credentials and then refactor our code to use Doppler to store those secrets instead. We'll use the open source Snyk goof project as a reference Node.js boilerplate application, so feel free to follow along with us.
Read Post

Copyright © 2024 OpsMatters™. All rights reserved.