PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Web2 bug repellant instructions

osec.io | blog | #web3 | #xss | #csrf | #marketplace | #frontend-security | #nft
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec surveys Web2 attack surface in Web3 apps — XSS via unsanitized NFT metadata on Rocki, malicious approval prompts, CSRF/XSS sinks — with practical mitigations.
Published
Collected

Related coverage

blog · bughunters.google.com
Enabling Trusted Types in a Complex Web Application: A Case Study of AppSheet
A Google case study on rolling out Trusted Types in AppSheet, covering how the team enforced DOM XSS protections in a complex production web application.
blog · bishopfox.com
Building Security at Scale: The AppExchange Story
The AppExchange origin story: Salesforce's 2007 trust bet, the first Chief Trust Officer, reviews evolving into automated security tooling, and economics that let thousands of developers sell in.
blog · blog.trailofbits.com
Secure your Apollo GraphQL server with Semgrep
Trail of Bits added nine Semgrep rules to detect CSRF, rate-limiting, and CORS misconfigurations in Apollo GraphQL server v3 and v4, with guidance on fixing common GraphQL security flaws.
blog · bishopfox.com
Google Partner Program – GPP Top 10
The top 10 most common, high-risk bug classes from 200+ Google Partner Program assessments, OWASP-inspired: insufficient authorization, XSS, CSRF, unsafe document processing, and more.
blog · bishopfox.com
Winston Privacy Version 1.5.4
Nine vulnerabilities in the Winston Privacy device 1.5.4 — critical unauthenticated command injection, CSRF, CORS issues, default credentials, undocumented SSH — fixed in 1.5.8.
blog · bishopfox.com
SFDC Secure Development Cheat Sheet
A Salesforce secure development cheat sheet for passing the AppExchange security review, covering XSS, CRUD/FLS, insecure sharing and storage, SOQL injection, external comms, and CSRF.
Back