Time to "leak" this old (but gold) pre-auth RCE affecting some of the Red Hat products. As stated by @joaomatosf this is an old but gold vulnerability found by himself and shared in two distinct security conference in Brazil, this vulnerability was part of…

Intro and Prior Work

Proof of concept code for Datadog Security Labs referenced exploits. - DataDog/security-labs-pocs

Conference: 9th - 10th June | Find out speakers for hardwear.io USA 2022

Every byte of a QUIC connection explained and reproduced

WSO2 RCE (CVE-2022-29464) exploit and writeup. Contribute to hakivvi/CVE-2022-29464 development by creating an account on GitHub.

Vulnerability Hunting for Sport If you've been following our blog, you might notice some favoritism when it comes to embedded targets... We'...

Cloud agnostic IAM permissions enumerator. Contribute to securisec/cliam development by creating an account on GitHub.

Understanding CVSS score is crucial to plan the vulnerability mitigation process using prioritization to reduce noise

Recently I came across a tweet by @CristiVlad25 asking about what you should write in a pentest report, when there are no findings? I did a quick quote tweet with the first thoughts that came to mi…

Posted in r/netsec by u/1winway • 86 points and 7 comments

You've probably heard about salting passwords, but a further technique, peppering, makes them even more secure. Here's how.

During a recent incident response engagement, the Profero IR team observed a sample of Hello Kitty ransomware. This version of ransomware…

This post walks through exploiting serverless environments and AWS Lambda functions via the CloudGoat vulnerable_lambda scenario.

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings). - Dec0ne/KrbRelayUp

Doyensec's Blog :: Doyensec is an independent security research and development company focused on vulnerability discovery and remediation.

Hi all,

Posted by u/Late_Ice_9288 - 5 votes and 4 comments

Team Nautilus found a flaw in npm that allows attackers to perform package planting and masquerade a malicious package as legitimate to trick developers

Application security issues found by Assetnote