As a web application firewall provider, part of our job at Imperva is constantly monitoring new security vulnerabilities. To do this, we use internal software that collects information from various data sources such as vulnerability databases, newsletters, forums, social media and more, integrate it into a single repository, and assess each vulnerability’s priority. Having this kind of data puts us in a unique position to provide analysis of all web application vulnerabilities throughout the year, view trends and notice significant changes in the security landscape. As we did last year, before we enter 2018, we took a look back at 2017 to understand the changes and trends in web application security over the past year.
This year we registered a record high number of web application vulnerabilities including well-known categories like cross-site scripting, but also new categories such as insecure deserialization. In addition, the number of internet of things (IoT) vulnerabilities continued to grow and severely impact the security landscape. WordPress and PHP each continued to “dominate” in terms of vulnerabilities published in the content management system and server side technologies respectively. Apache Struts vulnerabilities, although the framework is less popular in the market at large, had a huge effect and were claimed to be the root cause of one of the biggest security breaches in 2017.