Professional / Community 1.7.34

Summary: PortSwigger released Burp Suite Professional and Community 1.7.34 on 13 June 2018, fixing a bug that stopped Burp from validating the common name of the Collaborator server certificate when polling over HTTPS, and another that could leak HTTP Basic authentication credentials to another domain when following redirections. The release also fixed a bug allowing an active MITM attacker to spoof textual content in the BApp Store tab and updates dialogs, plus project repair, Linux autocomplete, temporary project saving, macOS app nap, and literal IPv6 proxy bugs, and updated ClickBandit for sandboxed iframes.
What's compelling: The credential leak required only that a user set Basic auth for domain A, scan it, and have it redirect to an in-scope domain B - a routine configuration that would hand an attacker working credentials, and the fixes were credited to researchers Bruno Morisson and Juho Nurminen through PortSwigger's bug bounty program.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026