API Security Weekly: Issue 169

This week, we have details of a vulnerability in the popular WordPress plugin, WP HTML Mail, which potentially exposed 20,000 WordPress sites, and a vulnerability in TeslaMate software exposing dozens of Teslas to remote access. On more positive news, we have an introduction to vAPI, an open-source laboratory for learning API security, and an article on how to reduce API attack surfaces.

Vulnerability: WordPress Sites Exposed by Insecure REST API

This week, we have another vulnerability in a WordPress plugin: this time, the popular WP HTML Mail plugin. The vulnerability is tracked as CVE-2022-0218 with a CVSS score of 8.3, and it was discovered by Wordfence researcher Chloe Chamberland. The vulnerability may have impacted up to 20,000 WordPress installations, rendering them vulnerable as a result of the cross-site scripting (XSS) bug courtesy of an unprotected REST API endpoint in the plugin.

Apache Kafka in the Public Sector — Part 4: Energy and Utilities

The public sector includes many different areas. Some groups leverage cutting-edge technology, like military leverage. Others like the public administration are years or even decades behind. This blog series explores how the public sector leverages data in motion powered by Apache Kafka to add value for innovative new applications and modernize legacy IT infrastructures. This is part 4: Use cases and architectures for energy, utilities, and smart grid infrastructure.

Blog series: Apache Kafka in the Public Sector and Government

This blog series explores why many governments and public infrastructure sectors leverage event streaming for various use cases. Learn about real-world deployments and different architectures for Kafka in the public sector:

Apache Kafka in the Insurance Industry

The rise of data in motion in the insurance industry is visible across all lines of business, including life, healthcare, travel, vehicle, and others. Apache Kafka changes how enterprises rethink data. This blog post explores use cases and architectures for event streaming. Real-world examples from Generali, Centene, Humana, and Tesla show innovative insurance-related data integration and stream processing in real-time.

Digital Transformation in the Insurance Industry

Most insurance companies have similar challenges:

7 Billionaires and Their Habits That Help Them Achieve Their New Year Goals

Ever wondered how the richest of the rich manage to scale up their profit and welcome the very new year with the same zest and confidence? The answer is they live their life with perseverance and passion. Nothing’s too easy unless you work hard for it. Many of the billionaires seem to have accepted this as their motto early in their life and are reaping the benefits of the same now.

Want to be successful and achieve all those resolutions you have on your bucket lists? Here’s a list of the seven most famous billionaires and their habits that help them tick-off all their new year resolutions.

Vue.js Tutorial: Build a Tesla Battery Range Calculator in Vue 3


This tutorial focuses entirely on the new driving experience. It is now clear that electric driving is the future. But how far can you actually ride on a full battery? And what influence does the speed, outside temperature, and size of the rims have on the range, for example? In this tutorial, we get started with Vue.js, an easy-to-understand JavaScript framework. We are going to make a dashboard with which we can calculate how much range the Tesla has under different circumstances.

As a starting point for the tutorial, clone this Github repository.

Introduction to Kubernetes Security

Kubernetes is fundamentally a complex system with lots of different potential attack vectors aimed at data theft currency mining and other threats. Brice Fernandes started us off with a discussion on how to secure your operations to Kubernetes using GitOps best practices. Liz Rice then followed up on the current state of Kubernetes security-related features as well as best practices and other tips on how to secure your cluster.

GitOps Is an Operations Model for Kubernetes

According to Brice, Kubernetes clusters were traditionally accessed by developers directly, using the command line tool `kubectl`. There are of course many issues with having your development team directly accessing the cluster in this way. The biggest problem with this is that it is really hard to audit and track who did what, when.