Sonar's latest blog posts

Featured Post

Announcing SonarSweep: Improving training data quality for coding LLMs

Recent research from Anthropic has shown that even a small amount of malicious or poor quality training data can have a massively negative impact on a model’s performance, exposing users to significant security and quality issues.

Read More
https://assets-eu-01.kc-usercontent.com:443/55017e37-262d-017b-afd6-daa9468cbc30/c4c32669-0e01-4074-926a-1b257686a90c/sonarsweep_blog_or_press_featured_with_mark__2x.webp
In this post, we will see how to completely disable external entities declaration and expansion, offering a quick and safe solution.
Blog post

How to disable XXE processing?

In this post, we will see how to completely disable external entities declaration and expansion, offering a quick and safe solution.

Read Blog >

Today XML External Entities (XXE) vulnerabilities are still ubiquitous, despite the fact that recommendations to protect against them have been an integral part of security standards for ...
Blog post

Don't be afraid of XXE vulnerabilities: understand the beast and how to detect them

Today XML External Entities (XXE) vulnerabilities are still ubiquitous, despite the fact that recommendations to protect against them have been an integral part of security standards for years. In this post, we will try to demystify XXE vulnerabilities and present the rule we put in place to help you detect and prevent them. 

Read Blog >

Get new blogs delivered directly to your inbox!

Stay up-to-date with the latest Sonar content. Subscribe now to receive the latest blog articles.

I do not wish to receive promotional emails about upcoming SonarQube updates, new releases, news and events.

By submitting this form, you agree to the storing and processing of your personal data as described in the Privacy Policy and Cookie Policy. You can withdraw your consent by unsubscribing at any time.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Image shows various elements of code security, languages and bugs
Blog post

WordPress 5.8.2 Stored XSS Vulnerability

We reported a Stored XSS vulnerability in WordPress (CVE-2022-21662) which remained unpatched for more than 3 years and affected the wordpress.org website.

Read Blog >

Vulnerability Research Highlights 2021
Blog post

Vulnerability Research Highlights 2021

Our research team looks back at a great year and summarizes the highlights of their vulnerability research in 2021.

Read Blog >

C++20 is here! It's a big release with many features designed to make your code easier, faster and safer. Let's see how the latest C++ analysis rules in SonarLint, SonarQube and SonarClou...
Blog post

Modernizing your code with C++20

C++20 is here! It's a big release with many features designed to make your code easier, faster and safer. Let's see how the latest C++ analysis rules in SonarQube for IDE, SonarQube Server and SonarQube Cloud can help us modernize our code to take advantage of some of the new features.

Read Blog >

Image shows various elements of code security, languages and bugs
Blog post

NodeBB 1.18.4 - Remote Code Execution With One Shot

We recently discovered three interesting code vulnerabilities in NodeBB 1.18.4, allowing attackers to compromise servers. Find out about the details in this article!

Read Blog >

Our code security advent calendar is back for the sixth consecutive year. We will release daily challenges until December 24th, get ready to fill your bag of tricks!
Blog post

Code Security Advent Calendar 2021

Our code security advent calendar is back for the sixth consecutive year. We will release daily challenges until December 24th, get ready to fill your bag of tricks!

Read Blog >

In this blog post, we share 10 security pitfalls for Python developers that we encountered in real-world projects.
Blog post

10 Unknown Security Pitfalls for Python

In this blog post, we share 10 security pitfalls for Python developers that we encountered in real-world projects.

Read Blog >

We discovered 3 more code vulnerabilities in the popular GoCD CI/CD system that can be chained by attackers to leak or modify internal code. Learn more in this blog post.
Blog post

Agent 008: Chaining Vulnerabilities to Compromise GoCD

We discovered 3 more code vulnerabilities in the popular GoCD CI/CD system that can be chained by attackers to leak or modify internal code. Learn more in this blog post.

Read Blog >

Check out the details of a Cross-Site Scripting bug in the BBCode processing in SmartStoreNET and how it can be chained into arbitrary code execution!
Blog post

SmartStoreNET - Malicious Message leading to E-Commerce Takeover

Check out the details of a Cross-Site Scripting bug in the BBCode processing in SmartStoreNET and how it can be chained into arbitrary code execution!

Read Blog >

We recently discovered critical security issues in the popular CI/CD solution GoCD that can be exploited by unauthenticated attackers
Blog post

Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD

We recently discovered critical security issues in the popular CI/CD solution GoCD that can be exploited by unauthenticated attackers

Read Blog >