SecurityMetrics Blog

BlogEngine.NET Directory Traversal + Remote Code execution

A remote code execution (RCE) vulnerability, CVE-2019-10719, was discovered in BlogEngine 3.3.7 and earlier. Leveraging a path traversal in...
View Post

Something from Nothing; a Pentest Story

While performing an external network layer penetration test I encountered a host that presented a single page that was essentially blank...

Top 15 ASV Scan Vulnerabilities and How to Fix Them

Vulnerability scans are automatic. They’re nonintrusive, similar to a security professional checking whether or not your front door is unlocked...

SecurityMetrics COVID-19 Coronavirus Update

For the last twenty years, SecurityMetrics’ mission has been to help customers close security gaps and prevent data compromise. With the upheaval...

PANscan 2020 Study Shows Unencrypted Credit Card Data Storage Up

PANscan searches business networks for unencrypted credit card numbers. Can businesses store credit card information? The short answer is, “yes.”...

CVE-2020-5497 - MITREid Connect Cross-site Scripting

MITREid Connect Cross-site Scripting Vulnerability: CVE-2020-5497 Here's the situation: I was performing a penetration test that integrated with...

What is Formjacking?

What is formjacking? Formjacking is a type of cyber attack where hackers inject malicious JavaScript code into a webpage form–most often a...

What is CCPA Compliance? What You Need to Know About the...

What is CCPA Compliance? Does CCPA apply to my business? CCPA stands for California Consumer Privacy Act. The CCPA was enacted to protect the...

Matt Halbleib: Director of Assessments

Matt Halbleib is Director of Assessments at SecurityMetrics. He holds QSA (Qualified Security Assessor), PA-QSA (Payment Application Qualified...

Apache Struts Vulnerability: What You Should Do

You may have seen news reports of a serious security vulnerability in Apache Struts 2, which is a popular open-source framework developers use to...

What is Vulnerability Scanning?

What is Vulnerability Scanning? Vulnerability scanners are technically computer programs that search systems for weaknesses. Hackers can take...

What is Network Security?

Network security consists of the policies, procedures, programs, hardware, software, and people you use to protect your corporate network. Network...

Zyxel Devices Vulnerable to Cross-Site Scripting on Login page

A reflected Cross Scripting vulnerability, CVE-2019-9955, was identified on several Zyxel devices, specifically on pages that use the mp_idx...

5 Tips to Implement Security Awareness at Your Company

Whether you’re a CIO, the head of IT, or in a non-security-related position, if your data security practices are unclear, your company is at a...

How Much does GDPR Compliance Cost?

How much does GDPR compliance cost? The answer is more complicated than a basic dollar amount. There are many factors that will scale the cost of...

Need help securing your business?

Request a quote!