Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research describes a JWT vulnerability in which some servers fail to properly verify token signatures, allowing tokens with invalid signatures to be accepted. An attacker can then supply an arbitrary claim in the JWT payload, such as changing...
SMTP header injection occurs when user input is placed into email headers without adequate sanitization, letting an attacker inject additional headers with arbitrary values. PortSwigger notes the flaw can be exploited to send copies of emails to third...
PortSwigger's research explains that cross-site request forgery arises when an application relies solely on HTTP cookies to identify the user who issued a request, since browsers attach cookies to requests regardless of origin and an attacker can build a...
Web cache deception exploits discrepancies between cache proxy and backend parsers, causing web servers to cache and serve dynamic content as though it were static. Attackers typically add fake static file extensions to dynamic URLs, such as changing...
PortSwigger Research describes a CORS misconfiguration in which an application's policy allows two-way interaction from all subdomains rather than a whitelist of trusted ones. The write-up notes this significantly increases attack surface, since an XSS...
PortSwigger describes a CORS misconfiguration in which a site's cross-origin resource sharing policy trusts an origin that uses unencrypted HTTP. Because an attacker positioned to view and modify a user's unencrypted traffic can control responses from that...
PortSwigger Research describes a CORS misconfiguration in which a site trusts arbitrary origins, effectively disabling the same-origin policy and allowing two-way interaction by third-party websites. When the site also sends...
An HTML5 cross-origin resource sharing policy controls whether and how content from other domains can interact with the publishing domain, and it can apply per-request access controls based on the URL and other request features. If a logged-in user visits...
PortSwigger Research describes cross-site request forgery vulnerabilities in GraphQL endpoints that arise when the content type is not validated. POST requests with a content-type of application/json are secure against forgery as long as that content type...
PortSwigger Research describes GraphQL suggestions as an Apollo feature where the server answers invalid queries with suggestions for valid queries of similar syntax. Because attackers can send intentionally invalid queries and collect the suggestions,...
PortSwigger Research describes GraphQL introspection as a feature that uses built-in queries to return information about a GraphQL schema, with customizable queries that let users specify the content and shape of the response. When enabled in production,...
PortSwigger Research notes that GraphQL servers, unlike REST APIs, operate on a single endpoint where the message body determines how the server handles each request. A publicly available endpoint is not a vulnerability by itself, but any attack on the...
PortSwigger Research describes a Burp Scanner finding that a GraphQL endpoint is publicly reachable, noting that GraphQL servers unlike REST APIs operate on a single endpoint where the message body determines how the server handles the request. The writeup...
PortSwigger Research describes Content Security Policy as a mechanism that mitigates cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution, specified through a response header or meta tag. The finding is that a site...
PortSwigger Research describes how Content Security Policy, a mechanism meant to block cross-site scripting by disabling untrusted JavaScript execution, can be bypassed for form hijacking when the form-action directive is not set. The guidance recommends...
PortSwigger Research describes a Content Security Policy finding where the policy allows clickjacking, noting that CSP is meant to mitigate cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution. The guidance is to set...
PortSwigger Research describes Content Security Policy as a mechanism that mitigates cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution, specified through a response header or meta tag. The entry states that...
PortSwigger Research describes a Content Security Policy weakness in which a site's style directives permit untrusted style execution, undermining CSP's role in mitigating cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript...
PortSwigger Research describes Content Security Policy as a mechanism that mitigates cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution, specified by a site in a response header or meta tag. The guidance says to...
PortSwigger Research describes Content Security Policy as a mechanism that mitigates cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution, specified in a response header or meta tag. It recommends replacing...
PortSwigger describes the Silverlight cross-domain policy as controlling whether Silverlight client components on other domains can have two-way interaction with the publishing domain. Any domain the policy allows can potentially attack users of the...
The Flash cross-domain policy controls whether Flash client components on other domains can perform two-way interaction with the domain that publishes the policy. If an allowed domain is compromised or malicious, content running there can gain full access...
PortSwigger describes stored DOM-based JSON injection as a flaw where user input is stored and later embedded into a response inside the DOM, then processed unsafely by a client-side script. DOM-based JSON injection specifically occurs when a script...
PortSwigger describes reflected DOM-based JSON injection as occurring when a script incorporates controllable data into a string that is parsed as JSON and then processed by the application, with the reflection letting an attacker control part of the...
DOM-based JSON injection occurs when a client-side script reads data from a controllable part of the DOM, such as the URL, and incorporates it into a string that is parsed as JSON and then processed by the application. An attacker can construct a URL that,...
PortSwigger describes stored DOM-based XPath injection as a flaw where user input is stored and later embedded into a response within a part of the DOM that a client-side script processes unsafely, letting an attacker control data that gets incorporated...
PortSwigger describes reflected DOM-based XPath injection, which occurs when data from a request is echoed into the immediate response in a part of the DOM that a client-side script then processes unsafely. When a script incorporates that controllable data...
DOM-based XPath injection occurs when a client-side script reads controllable data, such as from the URL, and incorporates it into an XPath query. An attacker can construct a URL that, when visited by another user, causes an arbitrary XPath query to...
PortSwigger describes stored DOM-based local file path manipulation, which occurs when user input is stored and later embedded into the DOM, then processed unsafely by a client-side script that uses that controllable data as the filename parameter to a...
Reflected DOM-based local file path manipulation occurs when a script uses controllable data as the filename parameter to a file handling API, and an attacker can construct a URL that causes another user's browser to open an arbitrary local file....