January 24, 2018 Application Security, Research Nadav Avital, Gilad Yehudai Deserialization Attacks Surge Motivated by Illegal Crypto-mining Imperva’s research group is constantly monitoring new web application vulnerabilities. In doing so, we’ve noticed at least four major insecure deserialization vulnerabilities that were published in the past year. Our...
December 28, 2017 Application Security, Research Nadav Avital, Natan Elul The State of Web Application Vulnerabilities in 2017 As a web application firewall provider, part of our job at Imperva is constantly monitoring new security vulnerabilities. To do this, we use internal software that collects information from various...
September 8, 2017 Application Security, Research Nadav Avital CVE-2017-9805: Analysis of Apache Struts RCE Vulnerability in REST Plugin Just two months ago we published an analysis of a critical remote code execution (RCE) security vulnerability in Apache Struts. Now Apache Struts has published a new version fixing yet...
August 24, 2017 Application Security, Research Nadav Avital Analysis of Ronggolawe Ransomware and How to Block It In the last few years ransomware attacks have been significantly on the rise. This infamous trend began by targeting end point users’ machines, such as personal desktop and laptops. Later,...
July 13, 2017 Application Security, Research Matan Lion, Nadav Avital CVE-2017-9791: Analysis of RCE in the Struts Showcase App in Struts 1 Plugin On July 7th, a new security vulnerability was published in Apache Struts 2 CVE-2017-9791 (S2-048[1]). Struts 2.3.x users with Struts 1 plugin, which includes the Showcase app, are vulnerable. Once...
March 13, 2017 Application Security, Research Mia Joskowicz, Nadav Avital CVE-2017-5638: New Remote Code Execution (RCE) Vulnerability in Apache Struts 2 On March 6th, a new remote code execution (RCE) vulnerability in Apache Struts 2 was made public. This recent vulnerability, CVE-2017-5638, allows a remote attacker to inject operating system commands...
