# AppSec Newsletter 0010

### Links

* \[artigo + video\] [Technical Introduction to Software Bill of Materials (SBOMs)](https://www.andrewhoog.com/post/technical-introduction-software-bill-of-materials-sbom/)
    
* \[artigo\] [5 Best Practices for Securing Your API Gateway](https://thenewstack.io/5-best-practices-for-securing-your-api-gateway/)
    
* \[tool\] [OWASP Risk Rating Calculator](https://owasp-risk-rating.com/)
    
* \[tool\] [dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start](https://github.com/goodwithtech/dockle)
    
* \[tutorial\] [New ways to inject system CA certificates in Android 14](https://httptoolkit.com/blog/android-14-install-system-ca-certificate/)
    
* \[academy\] [PortSwigger - NoSQL Injection](https://portswigger.net/web-security/nosql-injection)
    
* \[vuln\] [CVE-2023-42793: Critical Authentication Bypass in JetBrains TeamCity CI/CD Servers](https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/)
    
* \[video\] Guia De AppSec - Secret Rotation:
    

%[https://www.youtube.com/watch?v=1w6uStfemcg] 

### **Siga o Guia de AppSec nas redes!**

Site: [**guiadeappsec.com.br**](http://guiadeappsec.com.br)**Youtube:** [**youtube.com/@GuiadeAppSec  
Twitter**](http://youtube.com/@GuiadeAppSec%EF%BF%BCTwitter) **/ X:** [**twitter.com/guiadeappsec**](http://twitter.com/guiadeappsec)