Posted in r/netsec by u/Late_Ice_9288 • 63 points and 3 comments

JFrog’s Security Research team discovered 7 vulnerabilities in the ClickHouse database management software. Learn about the issues and how to mitigate the risks.

In October 2021, Apple released a fix for CVE-2021-30833. This was an arbitrary file-write vulnerability in the xar utility and was due to improper handling of path separation (forward-slash) characters when processing files contained within directory symlinks.…

With this series, we present the results of our research on the security of popular developer tools with the goal of making this ecosystem safer: today’s article revisits Git integrations.

Learn how CrowdStrike discovered a new vulnerability in the CRI-O Container Engine (CVE-2022-0811), and what organizations can do to remediate this vulnerability.

TL;DR Jump to the Ideas list.
Introduction This year is the second time we participate as a fork - Rizin, effectively continuing the tradition since the year 2015 (as the radare2 project).
Mentors Members of the Rizin and Cutter core teams have volunteered…

Open Source Security Guide. Learn all about Security Standards, Frameworks, Threat Models, Encryption, and Benchmarks. - GitHub - mikeroyal/Open-Source-Security-Guide: Open Source Security Guide. ...

Contribute to justinsteven/advisories development by creating an account on GitHub.

Vue.js users using the dependency “node-ipc” are experiencing a supply chain attack protesting the invasion of Ukraine, from a package named “peacenotwar”.

Contribute to He-No/ntlmrelayx2proxychains development by creating an account on GitHub.

Using a still unpatched vulnerability in the PHP library dompdf (used for rendering PDFs from HTML), we achieved RCE on a web server with merely a reflected XSS vulnerability as entry point.

ThreatMapper 1.3.0 Release
ThreatMapper 1.3.0 is a feature release, with a number of enhancements and fixes:
New Features

Secret Scanning: Scan containers and host filesystems, looking for possibl...

Learn how CVE-2022-0811, cr8escape, in CRI-O can lead to arbitrary code execution in Kubernetes and Openshift. Also how to detect & mitigate.

Over the years, large-scale scanning of the internet has enabled the security community to identify widespread vulnerabilities and mitigate them before they can be exploited.

Posted in r/netsec by u/zx2c4 • 272 points and 9 comments

Deep dive into puppeteer-extra-plugin-stealth—an instrumentation framework for sophisticated bot developers—and how DataDome detects it.

Hello World

Tool for automating customized attacks against web applications. Fully made in C language with pthreads, it has fast performance. - GitHub - CoolerVoid/0d1n: Tool for automating customized attacks...