ahmsec

Intro This is the backstory to CVE-2024-43488, which disclosed an RCE vulnerability in vscode-arduino. vscode-arduino was a VSCode extension that added Arduino support.

We’re often advised not to click untrusted links, but less often told why.

Here is a bug I reported to LastPass, copied below with some edits.

This tweet describes an interesting behavior: certain non-ASCII characters map to ASCII characters when converted to upper- or lower-case.

Suppose you’re at the latest hip coffee shop in town, enjoying their comfy chairs and high-speed wifi.

This post is about how I learned of JSONP as an attack vector.

CSRF is a prevalent and well-known vulnerability that affects web applications.

I know you’ve been waiting eagerly, but it’s finally here: my own personal blog!