In October of last year, I reviewed YWallet for security and privacy issues. This was the first audit I performed for the Zcash Ecosystem Security grant.
Today, the final report is being made available to the Zcash community at the link below.
The audit found…

> TL;DR The main objective of this research is to prove the possibility of having a variation of Prototype Pollution in other programming languages, including those that are class-based by showing Class Pollution in Python. > Background Prototype Pollution…

Posted by u/yurichev - 30 votes and 2 comments

Schedule, talks and talk submissions for CarolinaCon 2023

Read CircleCI’s security alerts from January 2023. Last updated 1/13/2023.

By Nati Tal (Guardio Labs)

pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely from memory - GitHub - naksyn/PythonMemoryModule: pure-python implementation of MemoryModule technique to...

Learn how Legit Security discovered a vulnerable GitHub actions workflow. Get details on the vulnerability and and what you can do to mitigate it.

⚡ATTENTION⚡ Devs that rely on hyper-rust: your own code should include limitations for HTTP Body size - Hyper library does not restrict by default. Find out more…

Contribute to numanturle/CVE-2022-44877 development by creating an account on GitHub.

Contribute to elttam/publications development by creating an account on GitHub.

Posted in r/netsec by u/postmodern • 0 points and 1 comment

SoftICE-like kernel debugger for Windows 11. Contribute to vitoplantamura/BugChecker development by creating an account on GitHub.

A comprehensive analysis of the year's new malware

Every week, almost without fail, I come across one thing that confuses, entertains, or most commonly infuriates me. I’ve decided to keep a…

API calls and requests for resources can sometimes be diverted toward a different endpoint on the same host, potentially resulting in DOM XSS’s that would otherwise be impossible to trigger, or other types of client-side vulnerabilities.