Digging Between the Couch Cushions – CouchDB CVE-2021-38295 Breakdown

In this blog post we’re going to take a look at the recent CouchDB vulnerability, CVE-2021-38295, which I was credited with discovering.

AppSec Cheat Code: Shift Left, Shift Right, Up, Down & Start

Seamless and unobtrusive security is the future. We are huge advocates of shifting left and moving security testing earlier in the development process.

Three Excellent API Security Practices Most People Neglect

Widely-used single-purpose products like Slack to cloud-based solutions like AWS and Microsoft Azure, APIs are used to drive business processes.

[Update] Using Components with Known Vulnerabilities

You would like to imagine that the attacker crafted a new exploit, leveraging a zero-day vulnerability that no one has any protection against.

Once upon a time there was a WebSocket

This is the story from one of our recent penetration testing engagements.

It’s Okay, We’re All On the SameSite

With Google’s recent announcement that all cookies without a SameSite flag will be treated as having SameSite=Lax set by default in Chrome version 80…

Using Components with Known Vulnerabilities

When dealing with cyber vulnerabilities, there are lots of threats that are unknown and ever changing that can put users at risk. 

Security Misconfigurations

The configuration of web and application servers is a very important aspect of web applications. Often times, failure to manage proper configurations…

Three C-Words of Web App Security: Part 3 – Clickjacking

Prologue back in April, called A Brief Evolution of Web Apps, to set the scene for those less versed in web application history.

Fuzz Testing

A brand new piece of software, a program, a network, or an operating system, you will want to test it for any bugs, coding errors or other potential issues