Creează un cont pentru a te abona la acest blog și a-i urmări articolele pe pagina Lectură.
-
One weekend, I decided to unpack some of the patches that Samsung have been sending out for their MagicINFO 9 solution.
-
In part 1 I detailed my approach to following a rabbit hole that almost turned into pre-auth remote code execution with a default setup.
-
Recently a past student came to me with a very interesting unauthenticated vulnerability in a Spring application that they were having a hard time exploiting.
-
In this blog post, I’m going to describe a relative new vector to achieve remote code execution via a JNDI Injection that I found independently to other researchers.
-
This blog post was authored by Sina Kheirkhah.
-
On March 2nd, I reported several security vulnerabilities to VMWare impacting their Identity Access Management (IAM) solution.
-
On May 27th, I reported a handful of security vulnerabilities to VMWare impacting their vRealize Operations Management Suite (vROps) appliance.
-
On December 3, 2021, Zoho released a security advisory under CVE-2021-44515 for an authentication bypass in its ManageEngine Desktop Central and Desktop Central MSP products.
-
When Justin Kennedy and Brandon Perry asked me if I was interested in performing a little audit together, I couldn’t resist.
-
In this blog post, I’m going to share a technical review of Dedecms (or “Chasing a Dream” CMS as translated to English) including its attack surface and how it differs from other applications.