Application Security
CWE-623 ActiveX Marked Safe For Scripting: Why It Hurts
Marking a restricted ActiveX control safe for scripting lets any web page drive it. Do not set the flag, and set the kill bit on controls you ship.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-622 Function Hook Arguments Not Validated: A Guide
Security software that hooks system calls must validate every argument it receives. When it does not, the hook becomes the attack surface.
Oct 18, 20262 min read
Application Security
CWE-621 Variable Extraction Error in PHP: Cause and Fix
Calling extract() on request data lets attackers choose which variables get overwritten. Learn the pattern and the safer options.
Oct 18, 20263 min read
Application Security
CWE-620 Unverified Password Change: How to Close the Gap
If your app lets someone set a new password without proving who they are, account takeover is one request away. Require the old password or another proof.
Oct 18, 20263 min read
Application Security
CWE-62 UNIX Hard Link: How It Happens and How to Fix It
A privileged program opens a file by name, and an attacker has swapped that name for a hard link to something sensitive. Here is how CWE-62 works and what to do about it.
Oct 18, 20264 min read
Application Security
CWE-619 Dangling Database Cursor: How It Leaks Access
A database cursor left open after an error can be reached by other users with the original privileges. Close cursors every time, including on exceptions.
Oct 18, 20262 min read
Application Security
CWE-618 Exposed Unsafe ActiveX Method: Risk and Fix
An ActiveX control that exposes dangerous methods lets a web page do things far outside the browser's security model. Here is how it goes wrong and how to contain it.
Oct 18, 20262 min read
Application Security
CWE-617 Reachable Assertion: When assert() Becomes a DoS
An assert() that an attacker can trigger turns a bad input into a crash. Learn where reachable assertions hide and how to handle input errors instead.
Oct 18, 20264 min read
Application Security
CWE-616 PHP Upload Variables Overwritten: Cause and Fix
Old PHP code trusted global variables like $userfile to describe an upload. An attacker can set them directly and point the app at any file on disk.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.