• July 13, 2017
• Application Security, Research
• Matan Lion, Nadav Avital

CVE-2017-9791: Analysis of RCE in the Struts Showcase App in Struts 1 Plugin

On July 7th, a new security vulnerability was published in Apache Struts 2 CVE-2017-9791 (S2-048[1]). Struts 2.3.x users with Struts 1 plugin, which includes the Showcase app, are vulnerable. Once...

• March 13, 2017
• Application Security, Research
• Mia Joskowicz, Nadav Avital

CVE-2017-5638: New Remote Code Execution (RCE) Vulnerability in Apache Struts 2

On March 6th, a new remote code execution (RCE) vulnerability in Apache Struts 2 was made public. This recent vulnerability, CVE-2017-5638, allows a remote attacker to inject operating system commands...

• March 8, 2017
• Application Security, Research
• Nadav Avital, Yakov Gerstein

Early Vulnerability Disclosure Thwarts WordPress Hackers

In late January, WordPress was made aware of a new vulnerability in its code. Taking a proactive stance, the content management system (CMS) vendor immediately shared it with major web...

• January 17, 2017
• Application Security, Research
• Mia Joskowicz, Matan Lion, Nadav Avital

Defend Against PHPMailer Vulnerability with 0day Protection

On December 25th 2016, a critical new vulnerability in PHPMailer was made public. The open source PHP library for email handling embeds email functionality in web applications. This recent vulnerability...

• December 29, 2016
• Application Security, Research
• Mia Joskowicz, Nadav Avital

The State of Web Applications’ Vulnerabilities in 2016

Part of our job on the Imperva web application security team is supplying inclusive mitigation to new security vulnerabilities in web applications as soon as they become public. Imperva continually...

• December 6, 2016
• Application Security, Research
• Deepak Patel, Matan Lion, Nadav Avital

Can the Phishing Menace be Reined in?

Phishing is the starting point for most data breaches. People are the weakest link to an organization’s security posture. Current approaches to controlling the proliferation of phishing have shown no...