TLDR Tech / Dev
Exploiting vulnerabilities in Johnson & Johnson web apps
Two vulnerabilities were identified in Johnson & Johnson's web applications, one affecting a campus recruiting system that exposed nearly 1,000 students' details, and the other allowing administrative takeover of an internal audit system used by 20 companies. The campus recruiting vulnerability came from a simple misconfiguration where an API key was used instead of proper token authentication, while the audit system's flaw involved unauthenticated access to sensitive employee information through poorly secured APIs.
Read the full story