In the last blog on fixing vulnerabilities with Veracode Fix, we looked at SQL Injection remediation in a Java application. Since then, we have released Fix support for Python (and PHP) and launched a new VS Code plugin that includes support for Fix. It seems appropriate, therefore, to look at resolving a problem in a Python app using Veracode Fix in the VS Code IDE. This time let’s examine a simple cross-site scripting (XSS) weakness.

There's no doubt that no organization wants to be the victim of a cyber attack, but even the most security-minded entity can find itself caught off-guard or exposed when a zero-day exploit is discovered.

A website vulnerability refers to a weakness or misconfiguration in the design, implementation, or operation of a website that can be exploited by attackers to compromise its integrity, availability, or confidentiality. These vulnerabilities can exist in various components of a website, including its code, server configuration, database, and third-party plugins or extensions.

Back in August 2023, Checkmarx and Sysdig announced a new partnership. This collaboration enables customers of both Checkmarx and Sysdig to leverage the comprehensive visibility offered by Sysdig Runtime Insights to get even more value from the Checkmarx One application security platform.

The Synopsys Cybersecurity Research Center (CyRC) has identified problems in Zephyr OS related to protecting against internet protocol (IP) address spoofing attacks. Zephyr OS is a popular real-time operating system used in connected, resource-constrained systems like Internet of Things and embedded devices. It is highly customizable and supports multiple architectures, systems-on-a-chip, and boards, making it useful for a wide range of applications.

PHP is a popular server-side scripting language that is widely used for web development. PHP developers can ship and deploy more high-quality software products by leveraging static analysis tools that help mitigate PHP code errors, security vulnerabilities, and other issues that can impact the quality and security of the application if not addressed early in the development cycle.

Zero-day vulnerabilities require an emergency response, disrupting proactive security initiatives and placing additional pressure on security teams. Despite not being the primary focus of their daily responsibilities, zero-days, especially those exploited in the wild, capture significant media attention. This often results in managers, executives, and even board members seeking immediate information about the company’s exposure to the latest threats.

Vulnerability management isn’t just about identifying weaknesses; it’s about effectively addressing them. How do you know if you’re on the right track? Are you effectively addressing vulnerabilities and minimizing risks? To answer these questions, you need more than just a list of potential metrics – you need clarity on what truly matters.

The Common Vulnerability Scoring System (CVSS) is a pivotal tool in the field of cybersecurity that helps determine the severity of software vulnerabilities. There are few people who haven’t heard of this scoring system, however, there are many who only know it as a scoring model versus an actual vulnerability matrix that offers a consistent framework for communicating the traits and effects of different vulnerabilities.

With springtime just around the corner, there’s a lot to be excited about — warmer weather, longer days, and, most importantly, basketball! In honor of the upcoming March Madness tournament, we’ve put together our own dream team for AppSec. Read on to discover the all-star features in application security this year and how they can help your team get a slam dunk in protecting applications from code to cloud.