Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On 24 September 2024, the security researchers at Astra discovered a critical broken access control vulnerability in the Class Committee Management System, an open-source project. The web-based system allows users to manage files, schedule meetings, generate reports, and access other management features. A broken access control vulnerability occurs when the application does not enforce proper permissions and restrictions.

Astra Security identified a vulnerability in the InvenTree Inventory Management System on October 2nd, 2024, which has since been patched. This vulnerability, CVE-2024-47610, is stored cross-site scripting (stored XSS) that targets versions of InvenTree below 0.16.5, where ‘Markdown,’ in the Notes feature, can enable attackers to run code. Cross-site scripting vulnerabilities allow a hacker to inject HTML code into an application and affect the users who intercept the code.

Engineering Leaders are stretched thinner than ever, racing to deliver innovative products and scale operations while securing a complex digital ecosystem across the increasing perimeter of code, DevOps, compliance, and more. Remember the infamous MOVEit attacks that compromised nearly 2,000 organizations, from BBC and Harvard to local government agencies. Over 67 million individuals were affected, underscoring the devastating consequences of such breaches.

Cybersecurity is no longer an awareness issue but a strategic execution problem. In 2023, 96% of CEOs acknowledged cybersecurity’s importance for organizational growth, stability, and competitiveness, but only 15% had dedicated board meetings to discuss cybersecurity issues. This disconnect between awareness and action stems primarily from difficulty quantifying cybersecurity goals, investments, and return on investment (ROI), making it easier to overlook or, at best, an afterthought.

On February 28, 2024, our team of pentesters at Astra discovered a critical stored cross-site scripting (XSS) vulnerability in the Personal Management System by Volmarg. This web-based tool helps you create to-do lists, take notes, and manage files in a convenient dashboard.

As organizations increasingly rely on cloud-based infrastructure and face growing cyber threats, traditional vulnerability scanners are no longer sufficient. Modern vulnerability management platforms must identify vulnerabilities and proactively assess their risks, prioritize remediation efforts, and provide comprehensive reporting.

The OWASP Mobile Top 10 lists the foremost crucial security risks in mobile applications. This list is essential for developers, security professionals, and organizations to prioritize their resources while addressing mobile app development vulnerabilities in order of severity.

Cybersecurity has evolved from a technical challenge to a strategic business imperative. CXOs now grapple with a complex interplay of technological advancements, organizational shifts, and human error, which is only intensified by Generative AI, insider threats, third-party vulnerabilities, and persistent threat exposure.

What is API Security Testing? API security testing is a process of carefully evaluating API endpoints to identify and remediate vulnerabilities such as fuzzy input, parameter tampering, or injection attacks. Acting as the first line of defense, it meticulously examines endpoints to identify and neutralize vulnerabilities before attackers can exploit them.

In the age of digital-first businesses, every other software solution either uses an API (Application Programming Interface) or makes one. They enable various applications and services to work together, enabling businesses to improve features, streamline user experience, and provide new exciting offerings. Unfortunately, the more APIs we collect and interact with, the more security challenges increase.