IT Hello
search
Category index

Cyber Security

4276 articles

4276 ARTICLES

FEATURED REPORT

Behind the disclosure: the Zip Slip vulnerability

In June 2018, the Snyk research team found many exploitable instances of the Zip Slip in various ecosystems that affected thousands of applications. This kind of wide reaching vulnerability requires a well thought out private disclosure process so that vulnerable libraries and projects are warned about their exposure before public disclosures are made. This post goes into the details of what we did throughout the process from discovery to disclosure, creating fix PRs and beyond.

BY —
MIN READ 1 MIN READ
EXPLORE north_east
Behind the disclosure: the Zip Slip vulnerability
How to crash an email server with a single email
CYBERSECURITY

How to crash an email server with a single email

It’s true you can crash an email server with a single email! This guest blog post talks about a vulnerability found in the top five Node mail parsers that will bring each of them down just by clicking send. Joran Greef explains how he found the vulnerability while he was writing his own mail parser and how he disclosed via Snyk’s security team.

1 MIN READ arrow_forward
How to educate, train and empower developers in security
CYBERSECURITY

How to educate, train and empower developers in security

The time has come for you to take responsibility of your application security. This may sound daunting to some of you, but don’t fret! There are many resources available to you, including The Secure Developer podcast, run by Snyk’s very own CEO, Guy Podjarny

1 MIN READ arrow_forward
Revisiting unit testing and mocking in Python
CYBERSECURITY

Revisiting unit testing and mocking in Python

This post covers some higher-level software engineering principles demonstrated in my experience with Python testing over the past year and half. In particular, I want to revisit the idea of patching mock objects in unit tests.

1 MIN READ arrow_forward
Zip Slip Vulnerability Cheat Sheet
CYBERSECURITY

Zip Slip Vulnerability Cheat Sheet

Zip Slip is a form of a Directory Traversal that can be exploited by extracting files from an archive. This cheat sheet informs you of vulnerable libraries and code snippets that are exploitable to a Zip Slip attack. Additionally it provides you with the information you need to upgrade to fixed library versions and offers tips on how to find and fix your own vulnerable code.

1 MIN READ arrow_forward
The most common vulnerabilities in Maven Central and npm
CYBERSECURITY

The most common vulnerabilities in Maven Central and npm

In this post we’ll look at the most common types of vulnerabilities for two of the main ecosystems we track in our vulnerability database, namely Maven Central and npm. The Snyk Vulnerability database consists of vulnerabilities from over 1,000,000 open source packages we track that use Composer, Go, Maven Central, npm, NuGet, pip and Rubygems.

1 MIN READ arrow_forward
Snyk <3 Jira
CYBERSECURITY

Snyk <3 Jira

Over the past few months, we’ve been working closely with customers who use Snyk alongside various issue trackers as a way of managing their vulnerability remediation process. The most popular ask has been an integration with Jira so that a Snyk vulnerability or license issue’s progress can be tracked, from disclosure, to assignment to the relevant person, and finally to remediation. We wanted to help speed up that workflow, and make raising a Jira issue as quick and easy as possible.

1 MIN READ arrow_forward
Introducing service accounts: API tokens for your org
CYBERSECURITY

Introducing service accounts: API tokens for your org

One of our most frequent feature requests recently has been for the ability to generate an API token that isn’t tied to a particular user. We’re excited to be able to now offer our pro and enterprise customers the ability to create service accounts – a special type of user that has an API token associated with it.

1 MIN READ arrow_forward