The security of our most sensitive web applications depends entirely on the strength and scope of the policies we put in place to protect them. Securing our applications starts with implementing powerful anti-virus and anti-malware policies, but it should also include policies against non-malware content threats, too. Allowing uploads from…

Insecure deserialization vulnerabilities represent one of the more common attack vectors pursued by threat actors in the modern day. Poorly configured data parsers can be tricked into passing harmful data into an application’s code base, and this mishap can trigger a variety of disastrous outcomes, including the infamous Denial of…

Poorly configured XML parsers are sometimes vulnerable to XXE (XML External Entity) threats. If a threat actor becomes aware of an XXE vulnerability in an application’s data parser, they can exploit it to retrieve sensitive data from the underlying application server with relative ease. Thankfully, XML External Entities can be…

The threat posed by MS document macros is nothing new. Since the introduction of macros almost 30 years ago, threat actors have leveraged this built-in file automation feature to programmatically unleash malware onto systems of all shapes and sizes, and they’ve done so with devastating effectiveness in many cases. …

Password protected files are a tried & true cyber-attack vector, allowing threat actors to inject malicious code into a system by hiding it behind the security and encryption features built into many common file formats. Since attacks using password protected files are typically carried out with social engineering tactics (i.e…

If we aren’t careful, motivated threat actors can compromise our system by injecting malicious scripts into seemingly innocent file formats. If we don’t detect these files right away, both internal and external system users are at major risk of losing valuable data, and our system might even be compromised entirely. …

Any time we allow external users to upload files to our storage instances, we need to implement rigorous anti-virus, anti-malware, and content verification policies to keep our systems safe. Using the free API provided in this article, you can easily scan files for virus, malware, and non-malware threats — including…

While most .EXE files we encounter are needed to run legitimate software applications, the executable file format also provides an ideal means for threat actors to inject malicious code into our system. As a result, it’s important to be extremely cautious about clicking on .EXE …

There are an overwhelming number of file formats which threat actors can use to exploit your file upload process. Thankfully for you, however, most of those formats are entirely unnecessary for your own business purposes. For example, if you’re designing a file upload process for users to store resumes in…