2

Let's take your Node.js example. You are using a version of with a known vulnerability. Therefore you have two options: Stay on the version that you know is vulnerable Upgrade to a version that may be vulnerable. The only correct choice is #2. Is it possible that you are upgrading to a version that also has vulnerabilities? Absolutely! In fact that is ...


1

When that link is clicked, an authentication page would show up in the machines internet browser and show a page where it asks for the user's company ID and birthday. This is not a safe on-boarding process to prove that a new app user is associated with an identity in active directory. Birthday and company ID are way too public, particularly to other users ...


1

For me, any of the above recommendations is a change that needs to be applied to a given application, host, etc. Totally agree on that point, and if you have a Change Management Process, all those changes should pass through it. how can one make sure that any of the changes does not lead to reduced or compromised security? How one can make sure that the ...


1

Lucky13 and Sweet32 are both attacks on SSL/TLS, i.e. these attacks can be used to intercept the encrypted connection between the client and the server. In the case of a server that is vulnerably to Lucky13, an active attacker may be able to launch a MITM attack by exploiting this vulnerability. The same applies to Sweet32, but even a passive attacker may ...


Only top voted, non community-wiki answers of a minimum length are eligible