enovate

The full top 25 list is a bit daunting and the assigned scores don’t change all that much once you get past the top offenders, so let’s start with just the top 10 to see what really matters: Top 10 CWEs for 2024 #1: Cross-site scripting (XSS, officially Improper Neutralization of Input During Web Page

Introducing brainstorm Brainstorm is a web fuzzing tool that combines local LLM models and ffuf to optimize directory and file discovery. It combines traditional web fuzzing techniques (as implemented in ffuf) with AI-powered path generation to discover hidden endpoints, files, and directories in web applications. Brainstorm usually finds more endpoints with fewer requests. The tool

It’s nearly 2025, yet SQL injection still ranks as the #3 most dangerous application security weakness. Despite tech industry hype suggesting that SQL databases are on their way out and it’s only a matter of time before they’re all replaced by NoSQL, GraphQL, or some other QL, SQL injections continue to feature in data breaches

The underlying vulnerability: Unsafe initialization vectors in TLS 1.0 The vulnerability in version 1.0 of the TLS (Transport Layer Security) protocol that was later exploited in the BEAST attack had been known since 2002 and fixed in the TLS 1.1 specification from 2006. It was considered impractical to exploit, as it required a huge number