Professional / Community 2022.11

Summary: PortSwigger released Burp Suite Professional/Community 2022.11 on 7 November 2022, moving all User and Project options into a new Settings dialog with per-setting markers for user or project level and an override toggle. The release also added DOM Invader detection of cross-domain web message leaks, an option to strip the Permissions-Policy header, WebSocket message interception in the Montoya API, and an upgrade to Chromium 107.0.5304.87.
What's compelling: DOM Invader can now flag pages that send URL data to a different target origin, a pattern the release says an attacker could use to steal sensitive data such as OAuth tokens by embedding the page in an iframe.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026