Vulnerability Management

A nasty SSRF bug in Web Services plagues a laundry list of enterprise printers.

About three-quarters of Java and .NET applications have vulnerabilities from the OWASP Top 10 list, while only 55% of JavaScript codebases have such flaws, according to testing data.

Organizations often defer patching because of business disruption fears — but that didn't work out very well for Rackspace's Hosted Exchange service.

The JsonWebToken package plays a big role in the authentication and authorization functionality for many applications.

A complete bypass of the Kyverno security mechanism for container image imports allows cyberattackers to completely take over a Kubernetes pod to steal data and inject malware.

Securing videoconferencing solutions is just one of many IT security challenges small businesses are facing, often with limited financial and human resources.

With a recession potentially coming, some companies are cutting security teams. But moving more infrastructure to the cloud and reducing the number of vendors through consolidation may be the best ways to prepare.

A successful attacker could use the SSRF vulnerability to collect metadata from WordPress sites hosted on an AWS server, and potentially log in to a cloud instance to run commands.

The Play ransomware group was spotted exploiting another little-known SSRF bug to trigger RCE on affected Exchange servers.

The latest bypass for Apple's application-safety feature could allow malicious takeover of Macs.

Effective customer data management helps companies avoid data breaches and the resulting cascade of issues. From validating "clean" data to centralized storage and a data governance strategy, management steps can help keep data safe.

Without many details, Apple patches a vulnerability that has been exploited in the wild to execute code.

Here's what you need to patch now, including six critical updates for Microsoft's final Patch Tuesday of the year.

Citrix issues a critical update as NSA warns that the APT5 threat group is actively trying to target ADC environments.

Out of more than 80 flaws fixed this month, the most critical was a system component bug that could allow RCE over Bluetooth.