86 Percent of PHP Based Applications Contain at Least One Cross-Site Scripting Vulnerability
Tuesday, December 8, 2015
Veracode is reporting that its analytics show 86 percent of PHP-based applications contain at least one Cross-Site Scripting (XSS) vulnerability and 56 percent have at least one SQL injection (SQLi) when initially assessed by Veracode. The analysis is part of a supplement to Veracode’s “2015 State of Software Security: Focus on Application Development”, which is a report based on benchmarking analytics from its cloud-based platform.
The report also indicates that four out of five applications written in PHP, Classic ASP and ColdFusion that were assessed by Veracode failed at least one of the OWASP Top 10 (an industry-standard security benchmark).
Veracode reports that these application vulnerability trends have also been seen across a wider family of web scripting languages, as applications written in Classic ASP and ColdFusion have are twice as likely to contain these flaws compared to more modern languages such as .NET and Java.
The 2015 report captures data collected over the past 18 months from more than 200,000 automated assessments performed for Veracode’s customers across a range of industries and geographies. Other findings provided in the report include
- Design of the language matters for security: Some languages are designed to avoid certain vulnerability classes. For example, by removing the need for developers to directly allocate memory, Java and .NET eliminate almost entirely those vulnerabilities dealing with memory allocation (such as buffer overflows). Another example is the default behaviors of some ASP.NET controls, which avoid common issues related to Cross-Site Scripting.
- Operating environment of the language matters for security: Some vulnerabilities are only relevant in certain execution environments. For example, some categories of information leakage are more severe for mobile, which combines large volumes of personal data with a number of always-on networking capabilities.
- Mobile development project teams need to focus on encryption: Eighty-seven percent of Android apps and 80 percent of iOS apps contained cryptographic issues according to the report. Veracode suggests this indicates that, while mobile app developers may be aware of the need for cryptography to protect sensitive data and thus use it in their applications, few of them know how to implement it correctly.
Read more: https://info.veracode.com/state-of-software-securi...
Adobe announces updates to Adobe XD Wednesday, September 19, 2018
Netmarble Corp releases Lineage 2: Revolution updates Wednesday, September 19, 2018
Changes to the way notifications work in iOS 12 you need to know Wednesday, September 19, 2018
Watch your step at Fog World Congress 2018 Wednesday, September 19, 2018
Cloud Native SDK for Kubernetes has been launched by Pulumi Tuesday, September 18, 2018
Stay UpdatedSign up for our newsletter for the headlines delivered to you