Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
Burp Scanner flagged a publicly available OpenAPI definition, which describes an HTTP-based API's structure in YAML or JSON and is designed to be processed by software for tasks like API integration and validation. PortSwigger notes that such a definition...
PortSwigger Research describes a JWT flaw in which a misconfigured server includes private key components in the optional "jwk" header of tokens it issues, defined in RFC 7517 and used to carry key data for algorithms such as HMAC or RSA. A malicious user...
A JSON Web Key Set is a JSON object holding JSON Web Keys, defined in RFC 7517, that authorization servers often publish at well-known URLs so clients can verify the signatures of issued JWTs. PortSwigger Research notes that a misconfigured server may...
PortSwigger Research explains that the robots.txt file instructs web robots such as search engine crawlers about which locations on a site they may or may not crawl and index. The file is not itself a security vulnerability, but it often identifies...
PortSwigger Research describes a Burp Scanner finding, issue 0x00600550, in which a valid private key is disclosed within a web application. The text states that disclosure of valid private keys may lead to unauthorized access to any systems that use them...
PortSwigger Research notes that applications sometimes disclose sensitive financial information such as credit card numbers in their responses. It cautions that a response containing a credit card number may not represent a security vulnerability, since...
PortSwigger Research notes that applications sometimes disclose sensitive personal information such as social security numbers in their responses. The text cautions that such a response may not represent a security vulnerability, since the number may...
PortSwigger Research describes a scanner finding in which private IP addresses reserved under RFC 1918 for internal networks are disclosed, even though those addresses cannot be routed on the public internet and are not usually discoverable the way public...
PortSwigger's guidance states that email addresses appearing in application responses are not necessarily a vulnerability, since contact information and web mail content legitimately contain them. It notes that developer and staff addresses, whether...
PortSwigger Research describes directory listing as a web server behavior where servers automatically list the contents of directories that lack an index page, letting an attacker quickly identify resources at a given path and move directly to analyzing...
PortSwigger Research describes publicly accessible backup files and outdated file copies as extra attack surface for web applications, noting that depending on server configuration and file type they can expose source code, configuration details, and other...
PortSwigger Research describes source code disclosure as server-side code ending up visible to users, often through typographical errors in scripts or misconfiguration such as failing to grant executable permissions to a script or directory. The disclosed...
PortSwigger Research describes a database connection string disclosure issue, in which a web application reveals the information a data source needs to connect to it, typically read from server-side configuration files or hard-coded into application source...
PortSwigger describes form action hijacking as occurring when an application places user-supplied input into the action URL of an HTML form, letting an attacker construct a URL that redirects the form to their own server when another user visits it. In the...
PortSwigger describes form action hijacking as occurring when an application places user-supplied input into the action URL of an HTML form, letting an attacker construct a URL that redirects the form to their own server when another user visits it. If the...
Client-side HTTP parameter pollution (HPP) vulnerabilities arise when an application embeds user input in URLs in an unsafe manner, letting an attacker construct a URL that, when visited by another user, inserts additional query string parameters into URLs...
Client-side HTTP parameter pollution (HPP) vulnerabilities arise when an application embeds user input in URLs in an unsafe manner, letting an attacker construct a URL that, when visited by another user, inserts additional query string parameters into URLs...
CSS injection vulnerabilities arise when an application imports a style sheet from a user-supplied URL or embeds user input in CSS blocks without adequate escaping, and the stored variant occurs when that input was submitted in a previous request and saved...
CSS injection vulnerabilities arise when an application imports a style sheet from a user-supplied URL or embeds user input in CSS blocks without adequate escaping, and they are closely related to cross-site scripting but often trickier to exploit....
Stored DOM-based DOM data manipulation occurs when user input is stored and later embedded into a response inside a part of the DOM that a client-side script processes unsafely. PortSwigger notes that an attacker can use the stored data to control part of...
Reflected DOM-based vulnerabilities occur when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely, letting an attacker control part of the response such as a JavaScript...
DOM data manipulation occurs when a client-side script writes controllable data, such as data from the URL, to a field within the DOM that is used in the visible UI or client-side application logic. An attacker can construct a URL that, when visited by...
Stored DOM-based document domain manipulation occurs when user input is stored and later embedded into a response in a part of the DOM that a client-side script processes unsafely, letting an attacker use controllable data to set the document.domain...
Reflected DOM-based document domain manipulation occurs when data from a request is echoed into the immediate response in a part of the DOM that a client-side script processes unsafely, letting an attacker use controllable data to set the document.domain...
DOM-based document domain manipulation occurs when a client-side script sets the document.domain property using controllable data, such as the URL, letting an attacker construct a link that makes a target page set an arbitrary document.domain value....
PortSwigger describes link manipulation as occurring when an application embeds user input into the path or domain of URLs that appear in its responses, letting an attacker construct a link that modifies the target of URLs within the response when another...
PortSwigger describes link manipulation as occurring when an application embeds user input into the path or domain of URLs that appear within its responses, letting an attacker construct a link that modifies the target of URLs in the response when another...
PortSwigger describes stored DOM-based link manipulation as a vulnerability where user input is stored and later embedded into the DOM, then processed unsafely by a client-side script. DOM-based link manipulation occurs when a script writes controllable...
Reflected DOM-based vulnerabilities occur when data from a request is echoed into the application's immediate response in a part of the DOM that a client-side script then processes unsafely. DOM-based link manipulation is a specific case where a script...
PortSwigger describes DOM-based link manipulation as a vulnerability that arises when a client-side script reads controllable data from the DOM, such as the URL, and writes it to a navigation target like a clickable link or a form's submission URL. An...