Erez Yalon

Erez Yalon heads the security research group at Checkmarx. With vast defender and attacker experience and as an independent security researcher, he brings invaluable knowledge and skills to the table. Erez is responsible for maintaining Checkmarx’s top notch vulnerability detection technology where his previous development experience with a variety of coding languages comes into play.

about 2 months ago
Amazon Confirmed and Fixed a High Severity Vulnerability of Broken Authentication in Amazon Photos Android App

Our research team at Checkmarx found that the Amazon Photos Android app could have allowed a malicious application, installed on the user’s phone, to steal their Amazon access token. The Android...

Read Now
6 months ago
Zenly Fixes User Data Exposure and Account Takeover Risks

According to their privacy policy, “Zenly is an app that makes it fun and easy to know what your friends and family are up to and keep memories of your real life interactions. With Zenly, you can...

Read Now
9 months ago
Trojan Source Vulnerability: Get Protection with Checkmarx SAST

Researchers with the University of Cambridge recently published research about “Trojan Source” vulnerability. It has the potential to affect most computer code compilers and many software...

Read Now
9 months ago
A New Type of Supply Chain Attack Could Put Popular Admin Tools at Risk

Researchers at Checkmarx and Intezer have found a way to take over Git repositories, which could be potentially exploited by threat actors and puts popular admin tools at risk. Joint research...

Read Article
9 months ago
Attackers Write Bugs as Well!

A new attempt to compromise a popular NPM package had occurred in the past few hours. The popular COA (Command-Option-Argument) package is a parser for command line options with around 9 million...

Read Article
10 months ago
UAParser.js – Attack & Preparations

A few days ago, CISA published an alert regarding malicious code discovered in an NPM package with close to 8 million weekly downloads, ”ua-parser-js”. A few days before, security researchers...

Read Article
about 1 year ago
API Crash Course: Broken Object Level Authorization Found in Coursera

In a year where “remote everything” became the norm, on-demand and e-learning courses, and the vendors powering these services, saw exponential growth. With this and as part of our ongoing...

Read Article
over 1 year ago
Cloud is native, but security isn�t: Shift your app sec testing approach

Cloud-native has evolved from a marketing term into a highly desirable and useful architecture choice, yielding significant benefits for designing, building, and deploying applications. But...

Read Now