Product update: Dynamic API Scanning, Recommendations & Classifications, and more
We know the importance of staying ahead of threats. At Detectify, we’re committed to providing you with the tools you need to secure your applications …
Detectify
Our Crowdsource ethical hacker community has been busy sending us security updates, including 0-day research. For Asset Monitoring, we now push out tests more frequently at record speed within 25 minutes from hacker to scanner. Due to confidentially agreements, we cannot publicize all security update releases here but they are immediately added to our scanner and available to all users.
The following are some of the security vulnerabilities reported by Detectify Crowdsource ethical hackers. We added these tests to the Detectify scanner from December 28 – January 8.
The Solar Winds Orion API is vulnerable to authentication bypass that could allow a remote attacker to execute API commands.
Apache Flink is vulnerable to a path traversal vulnerability in JobManager. An unauthenticated attacker can read system files on the server.
FortiWeb versions 6.3.7 (or earlier) and 6.2.3 (or earlier) are vulnerable to a blind SQL injection in the user interface of FortiWeb.
Ruby on rails versions 6.0.0 to 6.0.3.2 are vulnerable to an open redirect issue because the request parameter “location” was not validated.
The JD Edwards EnterpriseOne Application Interface Services (AIS) Server is vulnerable to an SSRF vulnerability.
The issue navigator in Atlassian Jira is vulnerable to prototype pollution which can be pivoted to an XSS.
We know the importance of staying ahead of threats. At Detectify, we’re committed to providing you with the tools you need to secure your applications …
What if we told you that our newly released API Scanner has 922 quintillion payloads for a single type of vulnerability test? A quintillion is …