Javascript
Fake npm Packages Found in GitHub Repository
Security researchers discovered four vulnerable npm packages uploaded to GitHub that were capable of collecting the user’s IP address, geolocation and device hardware data. Not all attacks have a high-visibility profile. Some ...
How Black Friday and Cyber Monday Can Go From a Retailer’s Dream Into a CiSO’s Worst Nightmare
The shopping season which begins on Black Friday rolling over to Cyber Monday, is actually one of the most critical times for online retailers. During this period promotions are offered, new products ...
Why and How are Enterprise Companies, Like eBay, Actively Port-scanning End-users’ Computers From Their Websites
You might have recently heard that eBay is performing port scanning, while online shoppers are visiting their website. At first glance, it will probably sound a bit strange, as port scanning is ...
Mitigating NoSQL Injection Attacks: Part 2
This is the second part of a two-part series on NoSQL injections. Last time, we covered the anatomy of a NoSQL injection, as well as how to mitigate it. In this post, ...
Mitigating NoSQL Injection Attacks: Part 1
In this first part of a two-part post series, we’ll reconstruct a NoSQL injection and cover the basics of mitigating it. In the second part, we’ll look at Server-Side JavaScript and Blind ...
92% of the world’s top websites expose customer data to attackers
Tala’s Global Data at Risk: 2020 State of the Web Report indicates that sensitive data like PII and credit card information has never been more at risk - and security effectiveness is ...
An Oxymoron : Static Analysis of a Dynamic Language (Part 5)
An Oxymoron : Static Analysis of a Dynamic Language (Part 5)Overcoming challenges using Code Property GraphsFrom the previous post we explored the idea of applying taint flow analysis upon an untyped and ...
An Oxymoron : Static Analysis of a Dynamic Language (Part 4)
An Oxymoron : Static Analysis of a Dynamic Language (Part 4)Taint Flow challenges in a world of untyped and async event handlingFrom the previous post we concluded that type-checking at compile-time can ...
An Oxymoron : Static Analysis of a Dynamic Language (Part 3)
An Oxymoron : Static Analysis of a Dynamic Language (Part 3)TypeScript to the rescueFrom the previous post we concluded that JavaScript contains a number of features that makes it a challenge to ...
An Oxymoron : Static Analysis of a Dynamic Language (Part 2)
An Oxymoron : Static Analysis of a Dynamic Language (Part 2)From client side JavaScript to server side NodeJsNow that you have reached here after reading the prior post , lets switch contexts ...
