Connect with us

Hi, what are you looking for?


Application Security

XSS Flaws Decline, DoS Becomes More Common: Imperva

Security firm Imperva has analyzed web application vulnerability trends in 2016 and determined that while some types of flaws have declined, others have become more common.

Security firm Imperva has analyzed web application vulnerability trends in 2016 and determined that while some types of flaws have declined, others have become more common.

Data collected by the company shows that the total number of vulnerabilities found over the past two years has increased, but the number of flaws affecting web applications has actually dropped.

Imperva believes this trend can be attributed to a shift in research focus (e.g. towards IoT devices), and is likely not caused by web applications being more secure than before. Furthermore, the company pointed out that its data sources don’t cover vulnerabilities in proprietary web application code.

More than a quarter of the flaws tracked by the company have been classified as high priority, indicating that they pose a serious risk to affected systems.

When it comes to vulnerabilities by attack type, Imperva has observed a significant increase in denial-of-service (DoS) bugs, but the rate of cross-site scripting (XSS) issues has declined over the past year. Buffer overflows also increased slightly in 2016, but directory traversals, remote file inclusion, cross-site request forgery (CSRF) and SQL injections remained at roughly the same levels.

As for vulnerabilities related to content management systems (CMS), the number of issues affecting Drupal and WordPress dropped significantly in 2016 compared to the previous year, but the number of flaws identified in less popular products, such as Exponent and dotCMS, has increased.

Experts believe CMSs with a smaller market share might have a larger proportion of flaws as a result of fewer resources and less investment in security.

Advertisement. Scroll to continue reading.

CMS vulnerabilities

Imperva has found that the number of vulnerabilities affecting programming languages such as PHP, Python, Ruby, Perl, ColdFusion and Go has increased in 2016 compared to 2015. PHP takes the lead in this category with a growth of more than 100 percent. The security firm believes this can be attributed to the release of a new PHP version in December 2015.

Programming language flaws

Related: Brute Force Attacks on WordPress Websites Soar

Related: Over 8,800 WordPress Plugins Have Flaws, Study Shows

Related: Joomla Patches Dangerous Security Flaws

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.