Highlights:
Bonnie: I have a new feature integrated into K.I.T.T.
Michael: Give me more details
K.I.T.T.: With my new friend EMBA I am able to find the weak spot in every firmware.
40 years later ....

Researched and written by: Caio Burgardt and Silton Santos

Understanding which PyYAML API versions are vulnerable with a testing matrix

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to …

In this blog post, we'll deep-dive into the SAML2 protocol, how IdP-initiated login works and how to implement it securely.

Leaked story timeline According to the timestamp of the github repository, an unidentified user uploaded the Insyde’s partial firmware solution (4.

What do wedding venues and malware have in common? I got to spend my weekend investigating them. A short post about interesting malware, and lessons learned.

POSIX noscript for mail security checks of domain names - GitHub - jeffbencteux/mailsecchk: POSIX noscript for mail security checks of domain names

CandyShop is a devsecops project for cybersecurity professionals to access scan results of most popular vulnerability scanning tools.

HackerOne report #1672388 by yvvdwf on 2022-08-17, assigned to @nmalcolm:

During the assessment of a PHP application, we recently came across a file upload vulnerability allowing the interpretation of PHP code inserted into valid PNG files. However, the image processing pe

Discover global private cryptographic keys embedded within the Siemens SIMATIC S7-1200/1500 PLC and TIA Portal product lines with Team82 and Claroty.

The Caffeine phishing-as-a-service platform has an intuitive interface, comes at a relatively low cost and provides many features and tools to its criminal clients.

Doyensec's Blog :: Doyensec is an independent security research and development company focused on vulnerability discovery and remediation.

a brief postMessage testing methodology

On a recent engagement I found myself testing a Kubernetes environment. Through application-level bugs I had gotten remote shell access to some of its containers. For further exploration and analysis…