GitHub Self-Hosted Runner Enumeration and Attack Tool - GitHub - praetorian-inc/gato: GitHub Self-Hosted Runner Enumeration and Attack Tool

TrustedSec's blog is an expert source of information on information security trends and best practices for strategic risk management.

Recently, a vulnerability was discovered, which allowed for unauthenticated remote code execution in the kernel context.

Contribute to vonahisec/CVE-2022-47966-Scan development by creating an account on GitHub.

Application security issues found by Assetnote

Andreas Happe sometimes blogs about development, life or security.

From subdomain takeover to phishing mails
TL;DR; if you have a subdomain takeover for a given domain, and default DMARC alignment settings, you can create emails that passes SPF and DMARC for phishing purposes. DKIM, however, cannot be passed for the domain…

Burp Suite extension for bypassing client-side encryption using custom logic for manual and automation testing. - GitHub - Anof-cyber/PyCript: Burp Suite extension for bypassing client-side encrypt...

Greetings to all readers,

Pinning your malicious cyber operations to the opposition

We demonstrate how the popular "Ransack" library (Ruby on Rails) can be abused to exfiltrate sensitive data via character by character brute-force, allowing for a full application compromise in some cases. An internet wide search identifies several hundred…

Risks in the software supply chain contribute to increased security debt, but there are ways organizations can pay it off.

Short overview of breach contents

Akamai researchers have analyzed a critical vulnerability in Microsoft's CryptoAPI that would allow an attacker to masquerade as a legitimate entity.

RedTeam Pentesting identified a vulnerability which allows attackers to craft URLs to any third-party website that result in arbitrary content to be injected into the response when accessed through the Secure Web Gateway. While it is possible to inject arbitrary…

Reflected XSS in a big e-store, their response & the power of Google dorks.

We recently discovered three vulnerabilities that allow arbitrary code execution on OpenEMR. Let’s see what we can learn from them and discuss their patches!

How the Open Source SIP server may be vulnerable to OS command injection (remote code execution) when misusing the exec module, how to exploit and then fix it.