Professional / Community 1.7.16

Summary: PortSwigger released Burp Suite Professional and Community 1.7.16 on 16 January 2017, adding a --user-config-file command-line option for launching Burp with a specified user configuration file, including extensions to load on headless systems. The release also applies URL-encoding by default in Burp Scanner and Intruder to handle Tomcat's stricter rejection of raw characters in query strings, fixes a headless-mode license activation bug, and moves logging options from the user level to the project level.
Bottom line: The Tomcat change means payloads that previously reached application code may now be rejected before they get there, so scan results from earlier versions can understate what an application actually exposes.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026