SecurityMetrics Blog

Where Did that Request Come From? CVE-2020-11682 (CSRF)

What is CSRF? Cross site request forgery, commonly referred to as CSRF (pronounced sea-surf), is an attack in which a user who is authenticated to...
View Post

Authorization Bypass: A Cautionary Tale CVE (2020-11679,...

Attackers: Known or Unknown? That is the question. Far too often I come across applications where developers have made every attempt to secure...

Penetration Testing FAQs

Whether your business needs a penetration test for an industry compliance requirement, or because of a security incident, the process can seem...

BlogEngine.NET Directory Traversal + Remote Code execution

A remote code execution (RCE) vulnerability, CVE-2019-10719, was discovered in BlogEngine 3.3.7 and earlier. Leveraging a path traversal in...

Something from Nothing; a Pentest Story

While performing an external network layer penetration test I encountered a host that presented a single page that was essentially blank...

CVE-2020-5497 - MITREid Connect Cross-site Scripting

MITREid Connect Cross-site Scripting Vulnerability: CVE-2020-5497 Here's the situation: I was performing a penetration test that integrated with...

WiKID 2FA Enterprise Server Cross-Site Scripting

A stored and reflected cross-site scripting vulnerability, CVE-2019-17114, was identified on WiKID Systems 2FA Enterprise Server version...

WiKID Systems 2FA Enterprise Server CSRF

Multiple Cross-Site Request Forgery issues, CVE-2019-17118, were identified on WiKID Systems 2FA Enterprise Server through version 4.2.0-b2053....

WiKID Systems 2FA Enterprise Server SQL injection

A SQL Injection vulnerability, CVE-2019-16917, was identified on WiKID Systems 2FA Enterprise Server through version 4.2.0-b2047. The uid and...

New (And Old) Apache Struts Flaw: CVE-2016-1000031

Apache Struts developers released another security announcement on November 5, 2018 -- two and a half months after their last big security...

SecurityMetrics Guide to PCI DSS Compliance

The SecurityMetrics Guide to PCI DSS Compliance will help you understand current PCI requirements and trends, so that you can better protect data...

2017 HIPAA Survey Results

How did organizations do with HIPAA compliance in 2017? Here are the results along with major takeaways to help you with your own HIPAA compliance efforts.

Do You Need a Web Application Penetration Test?

Do You Need a Web Application Penetration Test? It’s important for your business to find and remediate any vulnerabilities your web applications...

What is Network Penetration Testing?

What is network penetration testing? PCI DSS Requirement 11 calls for regular vulnerability scanning and penetration testing. Naturally,...

PCI Requirement 11: Vulnerability Scans and Penetration Tests

PCI Requirement 11 Vulnerability Scans: A vulnerability scan is an automated, high-level test that looks for and reports potential...

Need help securing your business?

Request a quote!

We are excited to work with you.

*Required

Thank you!

Your request has been submitted.