On 2024-01-15, a research was reported, involving , gaining initial access via Software misconfig, targeting GitHub to achieve Resp. disclosure.
Draw.io is a website for drawing diagrams. The first vulnerability is a simple SSRF bug because of a bad and manual blacklisting technique. The second issue is much cooler though. The website...
Skiff is an email provider that really doesn't want XSS on their website. First, they sanitize their emails using DOMPurify. After that, they do various transformations on the data, which is the...
Server side request forgery (SSRF) is a popular and impactful vulnerability when used correctly. In order to prevent this attack, processing is done on the URLs to ensure that no internal URLs are...
The Navigation API is supposed to be a replacement for the old History API. This is supposed to solve the problems of SPA client-side navigations. The navigation.entries() function is used to...
The author got code access from a friend to some of the Mozilla infrastructure. They use SCM for version control, which is where the bug is at. pash appears to be a small shell that was used for...
Back in the day, websites were truly static, with only HTML and CSS being returned. Over time, responsive web design became a thing with AJAX/XHR requests being made in the background to get the...
Wiz becomes the first CNAPP to provide AI security for OpenAI, allowing data scientists and developers to detect and mitigate risk in their OpenAI organization with a new OpenAI SaaS connector.
Chapter II. Russian language cybercriminal forums – not always underground but always aiming at generating maximum profits. Welcome to...
On 2024-01-11, a research was reported, involving , gaining initial access via Software misconfig, targeting GitHub to achieve Resp. disclosure.
On 2024-01-11, an incident was reported, involving an unknown actor, gaining initial access via Exposed secret, while using Cloud API e, Create new cloud user, targeting S3 Bucket to achieve...
On 2024-01-11, a campaign was reported, involving Dreambus operator, gaining initial access via Software misconfig, 1-day vulnerability, targeting Apache RocketMQ, Metabase to achieve Resource...
FBot is a Python-based hacking toolkit, targeting web servers, cloud services, and SaaS platforms like AWS, Office365, PayPal, Sendgrid, and Twilio. FBot's primary purpose is to enable actors to...
The author of this Tweet has made over 500K in SSRF bugs. In this thread, they go through their best tricks. The first trick, is using other URL schemes like file:// and many others. This can lead...
Powered by Snowflake, Wiz delivers a Cloud Native Application Protection Platform (CNAPP) to joint customers.
Security researchers say that there has been a "resurgence" in email scams related to notorious sex offender Jeffrey Epstein.
On 2024-01-10, a campaign was reported, involving UNC5221, gaining initial access via 0-day vulnerability, targeting Ivanti Connect Secure VPN with unknown impact. The following tools were...
On 2024-01-10, a campaign was reported, involving an unknown actor, gaining initial access via 1-day vulnerability, Software misconfig, targeting Apache Flink, Apache Hadoop, Spring Framework,...
Researchers identified attacks targeting Microsoft SQL (MSSQL) servers to encrypt the victims' files with Mimic (N3ww4v3) ransomware. The attacks are tracked as RE#TURGENCE and have been observed...
Steam remote play is a peer-to-peer system for playing video. The author of this video reverse engineered the protocol to understand how it worked, build a fuzzer and find fun vulnerabilities in...
Osmosis is a very popular blockchain in the Cosmos ecosystem. Levana in a perpetual swap built on Cosmos (CosmWasm?). On December 26th, a large chain congestion occurred via a bad set of...
In Solidity, msg.data is the incoming data in the request as defined by the ABI. Using a hash of this for some cryptographic operation is a real bad idea. But why? The original issue with this...
We've curated a collection of 10 AI security articles that cover novel threats to AI models as well as strategies for developers to safeguard their models.
Bridges are an important piece of the blockchain ecosystem. Being able to move assets from one chain to another is a necessary requirement in the modern web3 space. However, doing bridges securely...
The Sonos Era 100 speakers uses UBoot for the basic boot process. UBoot is a common microcontroller boot framework that has a lot of existing functionality but can be crafted for whatever you...
Cookies are a core part of browser mechanics. Understanding how they work is important when escalating existing issues. In this article, the author dives into quirks of various frameworks and...
IppSec is a YouTuber with great hacking videos. This is a search engine for timestamps in their videos. So, if you need a video example of a bug class, this is a great resource.
| Nigel Douglas As a Developer Advocate working on Project Falco, Nigel Douglas plays a key role in driving education for the Open-Source Detection and Response (D&R) segment of cloud-native […]...
DNS rebinding is a fairly well-known attack used in various situations. The idea is to trick the browser on the origin of the website by changing IP address between DNS requests. For instance, if...
Ensure you are staying secure as your organization adopts AI by following these four guiding questions