Administration

• How do I grant Contrast access to my account for real time assistance?
• Does Contrast Security have a Bug Bounty program?
• Can I have a free trial or demo of Contrast?
• How often is maintenance conducted on Contrast's SaaS systems?
• How do the Contrast agents behave if the Contrast server is unavailable?
• Can I bypass email activation when creating new users?

See all 10 articles

Contrast UI

• Which URL in the Contrast UI should be used by a load balancer health check?
• Why does Contrast report an increasing number of URLs in an application?
• Why does my application show as offline, whilst the server shows online?
• Why is the On-Premise keystore password stored in plain text?

Java Agent

• Are old libraries automatically removed from Contrast?
• How do I tell if my application is still using the deprecated Java launcher jar? 
• How does the Java agent handle application naming
• Is the contrast.jar signed?
• Java Agent Effects on Application Performance (Assess)
• Legacy Java Configuration Properties

See all 7 articles

.NET Agent

• Deprecated .NET Framework Agent configuration options
• How does the .NET Framework agent handle application naming?
• How Does the Contrast .NET Agent Work?
• Is it possible to prevent an IIS restart following installation of the .NET agent?
• Why did my PowerShell uninstall of the .NET Framework agent not succeed?
• Why do my .NET servers and applications sometimes show offline in the Contrast UI?

See all 7 articles

Policy Management

• How do I check the library scores for an application?
• Understanding Contrast Log Enhancers
• Contrast Security CWE Protect Rule Mappings
• Why doesn't the sanitizer or security control I am using show up in the Contrast data flow?
• What information does Contrast capture?
• Why are some Assess rules disabled by default?

See all 8 articles

Vulnerability Lifecycle

• What is the data retention policy for Contrast findings?
• How do I manage vulnerabilities across build versions?
• Will vulnerabilities be automatically closed after code changes?
• How do I handle findings in out-of-reach code?
• Can I import a vulnerability into the Contrast UI?

Node.js Agent

• Command line arguments for the Node.js Agent
• Does the Node.js agent affect my application's performance?
• How is the application URL set by the Node Agent?
• What is dependency confusion?

Integrations and Plugins

• How do I get a .pem file for ADFS SSO integration?

Protect

• Q&A: How Does the New Contrast Protect Class Loader Manipulation Rule Block Spring4Shell and Future Exploits?
• How the Contrast agents handle XXS attacks in Protect

SCA

• Spring-web Java Deserialization: CVE-2016-1000027
• Why is Contrast Security reporting different information to that published by NVD?

Ruby Agent

• Running Contrast Ruby agent in testing suites

Support Bulletins

• Support Bulletin: Hardcoded Single-Sign On Certificate Update
• Support Bulletin: Library Scoring Migration to CVSS 3.1
• Support Bulletin: End of Support for On-Premises Contrast Server on Java 8
• Support Bulletin: Agent Traffic Disruption [RESOLVED]
• Support Bulletin: Latest Java Digital Signature Zero-Day (CVE-2022-21449)
• Support Bulletin: SSO Login Issues to Contrast SaaS [RESOLVED]

See all 24 articles

Alerts

• CVE-2022-3786: OpenSSL 3.0 buffer overrun CVE