WordPress 5.0.0 Remote Code Execution

19 Feb 2019 by Simon Scannell

WordPress Remote Code Execution

This blog post details how a combination of a Path Traversal and Local File Inclusion vulnerability lead to Remote Code Execution in the WordPress core. The vulnerability remained uncovered in the WordPress core for over 6 years.

Read More

Security Testing Plugin for Maven & Gradle

5 Feb 2019 by Julian Karl, Amin Dada

Maven Gradle Security Testing

We are pleased to announce integration support for the two major build automation tools Apache Maven and Gradle. Both plugins enable to add our static code analysis solution to your build process and to provide a streamlined way to configure and start a new security scan for your Java applications.

Read More

CTF Writeup: Complex Drupal POP Chain

29 Jan 2019 by Simon Scannell

Drupal

A recent Capture-The-Flag tournament hosted by Insomni’hack challenged participants to craft an attack payload for Drupal 7. This blog post will demonstrate our solution for a PHP Object Injection with a complex POP gadget chain.

Read More

Learnings from WordPress Security Month

15 Jan 2019 by Simon Scannell

Advent

Last year in December we released once a day a vulnerability affecting WordPress core or one of the most popular WordPress plugins, next to a critical persistent XSS in wordpress.org. This blogpost will summarize common mistakes developers make and the overall impact our advent calendar had on the WordPress community and the current state of WordPress security.

Read More

RIPS 3.0 Supports Java Security Analysis

7 Jan 2019 by Martin Bednorz

RIPS 3.0 user interface

We are excited to start the year 2019 with a new major release and milestone. RIPS 3.0 adds support for analyzing Java code for security and quality issues. Find out more about our unique code analysis approach and other new RIPS features.

Read More