Oxeye | Blog

Mar 21, 2023

3 Key Takeaways From Gartner®'s Market Guide™ For Cloud Native Applications Protection Platform (CNAPP), 2023

We provide a list of three key takeaways from the latest market report for Cloud Native Application Protection Platforms (CNAPP) from Gartner

Feb 28, 2023

Webinar: Why the 'A' in CNAPP is So Important - Application Security in the Age of Cloud Native Applications

Ory Segal, CTO of Prisma Cloud at Palo Alto Networks and Ron Vider, CTO of Oxeye, talk about CNAPP, and the convergence of application security and cloud security

Future of Application Security and why current SAST and DAST don't work anymore

Jan 27, 2023

Webinar: Stop Flying Blind in AppSec with Jim Manico and Dean Agron

Jim Manico and Dean Agron discuss the future of application security and why legacy SAST and DAST tools do not work for modern, distributed applications

Dec 20, 2022

5 Application Security (AppSec) Predictions for 2023

We talked to a lot of application security and cloud security owners this year. Here are our predictions based on those conversations.

Nov 28, 2022

Why Software Composition Analysis (SCA) Tools Must Transform to Enable Stronger Software Supply Chain Security

For many years, traditional Software Composition Analysis (SCA) tools have been the go-to for dealing with vulnerabilities in open source packages.

Nov 15, 2022

Remote Code Execution in Spotify’s Backstage via vm2 Sandbox Escape (CVSS Score of 9.8)

The Oxeye research team has found a critical vulnerability in Spotify’s open source, CNCF-incubated project — Backstage. We reported this via Spotify’s bug bounty program and it was rapidly patched in version 1.5.1. It ranked this critical vulnerability with a CVSS score of 9.8.

Sandbreak vm2 sandbox vulnerability - CVE-2022-36067

Oct 10, 2022

Enter "Sandbreak" - Vulnerability In vm2 Sandbox Module Enables Remote Code Execution (CVE-2022-36067)

The Oxeye research team has found a critical remote code execution vulnerability in the popular sandbox library VM2 - CVE-2022-36067

Sep 11, 2022

Guess Who’s (R)BAC?

The Oxeye research team recently found several high severity insecure direct object reference (IDOR) vulnerabilities in Harbor – a CNCF-graduated, open source artifact registry.

Aug 28, 2022

Oxeye Now Integrates with Jira

Bridging the gap between security findings and developers has never been easier.

Jul 28, 2022

“ParseThru” – Exploiting HTTP Parameter Smuggling in Golang - Updated October 10, 2022

Oxeye’s security research team has found a security vulnerability in Golang-based applications. Under certain conditions, it lets a threat actor bypass validations based on HTTP request parameters due to the use of unsafe URL parsing.

Jul 14, 2022

Diving Into OpenTelemetry’s Specs – The Story of How I Wrote Another Instrumentation

An unraveling of OpenTelemetry’ internals through a hands-on experience.

Jun 15, 2022

Runtime SBOM – Secure Microservices with Runtime Visibility

A software bill of materials is a list of all building blocks comprising an application – both the open source and commercial libraries.

Mar 20, 2022

Essential Takeaways for Cloud-Native Application Security Testing

The shift to cloud-native development affects several important aspects related to application security.

Mar 9, 2022

Software Composition Analysis (SCA) & Cloud-Native Application Security

Software Composition Analysis (SCA), identifies known vulnerabilities in 3rd party open source software components. It is not enough to assure that your apps are free from application layer vulnerabilities.

Mar 1, 2022

You Can’t IAST Your Way Out of This One

Why Legacy IAST Tools Will Fail Miserably When Testing Cloud-Native Web Applications.

Who owns cloud native application’s security

Jan 31, 2022

Who is responsible for Cloud Native Security?

Responsibility for App Security is no longer in the hands of one-owner, it’s a joint effort. App security is distributed to many groups and to different roles - Developers, AppSec and DevOps. So who’s incharge of security? And how to do it right.

Competitive analysis chart of SAST, DAST, SCA, IAST, and API testings and fuzzers

Jan 24, 2022

Why SAST doesn’t work in a cloudy world: 3 reasons SAST can’t support cloud native apps

Static application security testing tools (SAST), fail to provide the security measures required for cloud native apps. They lack context and are often limited to only one programming language, framework, or sets of libraries.

Jan 4, 2022

DAST & Cloud-Native Web Apps - Like Bringing a Knife to a Gunfight

Dynamic Application Security Testing tools (DAST), and why they fail to successfully test cloud native apps for code vulnerabilities. DAST tools lack the visibility into the communication layer of both app, container and cloud.

Dec 22, 2021

How insecure application tracing and telemetry may lead to sensitive data and PII leakage

Recently, Oxeye’s research team discovered several scenarios where sensitive data was leaked through tracing and telemetry collection within cloud-native applications.

Dec 21, 2021

How Legacy AST Tools Fail to Secure Cloud Native Applications

Herein is an overview of AST and the challenges that DAST, SAST, IAST, and SCA tools face when assessing vulnerabilities in cloud native applications.

Dec 14, 2021

How Contextual Risk Analysis Helps AppSec Teams Better Mitigate Log4Shell (CVE-2021-44228)

Which approach should application security teams take to protect against log4shell. Oxeye helps identify, mitigate and provides context to the Java logging package Log4j vulnerability also called LogJam CVE-2021-44228.

Nov 24, 2021

Cloud Native Apps & Microservices Need a New Security Testing Approach

Given the intricacies of cloud native apps, it's critical for organizations to prioritize security during their build phase

Nov 9, 2021

Contributing Open Source Code to the OpenTelemetry Project

OpenTelemetry is an open-source project by the Cloud Native Computing Foundation (CNCF).

Oct 28, 2021

When Cloud Native Application Security Testing Fails: A Real-World Analysis

Cloud native application vulnerabilities are not singular events, but rather complex flows. Our blog brings a few real-life examples from Shopify.

Oct 18, 2021

The Cloud Native Application Security Challenges and How to Avoid Them

Over 500 million applications will be deployed using cloud-native approaches by 2023, according to IDC.

Oct 10, 2021

Introducing Oxeye - Cloud-Native Application Security Testing, Here We Come

Cloud-native has evolved from a marketing term into a highly desirable and useful architecture choice, yielding significant benefits for designing.

Oxeye Blog