Additionally, Salt Security has added a Salt Posture Governance Policy Hub through which controls can be enforced across the application lifecycle, including now in the design phase of an API.

Salt-Labs researchers uncover security issues that may have allowed attackers to leverage a vulnerability commonly believed to be obsolete.PALO ALTO, Calif., July 29, 2024 /PRNewswire/ -- Salt Security , the leading API security company, today released new threat research from Salt-Labs , highlighting critical security flaws within popular web analytics provider Hotjar and a renowned global news outlet - highlighting elevated risk for enterprises. Hotjar is a leading solution for product teams who want to go beyond traditional web and product analytics so they can empathize with and understand their users—to connect the dots between what's happening and why it happens, so they can improve the user experience (UX) and create customer delight. The company serves over one million websites, including global brands. These vulnerabilities could have potentially allowed an attacker unlimited access to sensitive data sets within these services, affecting millions of users and organizations worldwide.These findings are not exclusive to these services but highlight a bigger issue that likely exists within similar ecosystems.The resurrection of an age-old security issueCross-site scripting (commonly known as XSS) is a security issue that has existed since the early days of the World Wide Web. It has since been analyzed and mitigated in many layers using countless techniques, ultimately reducing its overall security risk to a minimal level. However, the emergence of new technologies can cause a major ecosystem change, which introduces new opportunities for attackers to leverage historical flaws such as XSS and escalate security risk significantly.Recent Salt-Labs research demonstrates exactly this point, notably when combining XSS and recently popularized technology known as OAuth

Salt Security have announced the release of its new multi-layered OAuth protection package to detect attempts to exploit OAuth and proactively fix vulnerabilities.