Knowledge Base

What Is Cross-Site Request Forgery (CSRF)

Oct 18, 2022 | Knowledge Base

Cross-site request forgery (also known as CSRF) is an internet security vulnerability that allows an attacker to trick a user into performing an action they don't want. This allows attackers to partially bypass the same-origin policy designed to prevent different websites from interfering with each other. A successful CSRF attack forces the victim user to perform an unintended action. For example, changing your account email address, changing your password, sending money, etc. Depending on the nature of the action, the attacker could gain complete control of the user's account. If the...

What Is Open Redirect Vulnerability

Oct 18, 2022 | Knowledge Base

An open redirect vulnerability occurs when an application allows a user to control redirects or redirect to another URL. If the app fails to validate untrusted user input, an attacker could provide a URL that redirects an unsuspecting victim from a legitimate domain to the attacker's phishing site. Attackers exploit open redirects to make phishing attacks more credible. Most users check for legitimate and trusted domains but are unaware of redirects to phishing sites. Although this vulnerability does not necessarily directly affect legitimate applications, it can adversely affect the...

What Is Prototype Pollution

Jan 10, 2022 | Knowledge Base

Prototype Pollution Bugs Prototype Pollution is a vulnerability that allows attackers to exploit the rules of the JavaScript programming language, by injecting properties into existing JavaScript language construct prototypes, such as Objects to compromise applications in various ways. JavaScript allows all Object attributes to be altered. This includes their magical attributes such as __proto__, constructor and prototype. An attacker is able to manipulate these attributes to overwrite, or pollute a JavaScript application object prototype of the base object, by injecting other values....

What Is Remote Code Execution

Nov 18, 2021 | Knowledge Base

Improper Control of Generation of Code ("Code Injection") The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. When software allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the software. Such an alteration could lead to arbitrary code execution. Injection problems encompass a...

What Is Improper Input Validation

Aug 18, 2021 | Knowledge Base

Improper Input Validation Bugs The software receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. When software does not validate input properly, an attacker is able to craft the input in a form that is not expected by the rest of the application. This will lead to parts...

What Is Cross-site Scripting (XSS)

Jul 12, 2021 | Knowledge Base

Improper Neutralization of Input During Web Page Generation The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Cross-site scripting (XSS) vulnerabilities occur in specific conditions Untrusted data enters a web application, typically from a web request. The web application dynamically generates a web page that contains this untrusted data. During page generation, the application does not prevent the data from containing content that is executable by a web browser, such as...

What Is SQL Injection (SQLi)

May 24, 2021 | Knowledge Base

Improper Neutralization of Special Elements used in an SQL Command The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. This can be used to alter query logic to bypass security checks, or to...

Get started today. Now with 10-16% off!

Knowledge Base

What Is Cross-Site Request Forgery (CSRF)

What Is Open Redirect Vulnerability

What Is Prototype Pollution

What Is Remote Code Execution

What Is Improper Input Validation

What Is Cross-site Scripting (XSS)

What Is SQL Injection (SQLi)

Standard Plan

WordPress Maintenance and Security Updates