Prompt Injection in AI: Common Attack Scenarios and How to Mitigate Them

SLUBStick risk assessment for embedded systems The Linux kernel is susceptible to memory safety vulnerabilities due to its size and complexity.

An incomplete review of the sandbox solutions on the GNU/Linux operating system.

poc for CVE-2024-38063 (RCE in tcpip.sys). Contribute to ynwarcs/CVE-2024-38063 development by creating an account on GitHub.

Download Request Interceptor for Firefox. A Firefox extension that intercepts and edits HTTP requests, allowing you to view, customize, and send them directly from your browser. Incredibly easy and comfortable to use. Good for penetration testers and developers.

SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the process of constructing and utilizing structures, assigning varia...

This presentation covers a static analysis tool Semgrep and how it can be leveraged to find different vulnerabilities in a variety of languages. We initially presented “Automated Bug Hunting with Semgrep” at a local event in San Diego. Due to the positive…

Surprisingly often, implementations include functionality where user input is passed to dangerous functions like PHP’s eval() - despite clear warnings. Often, devs are somewhat aware of this danger and attempt to sanitize the input, but this approach …

Black Lotus Labs uncovered a zero-day exploit in Versa Director servers. Learn its impact on SD-WAN security and how to mitigate threats.

In just three Sunday afternoons, I discovered 14 CVEs - and you can too! CVE hunting is more accessible than many realise, and the methodology outlined here requires only a bit of coding knowledge.

Introduction Nothing special here. Got some free time to play around and decided to explore a free VPN from android play store in hopes to find something interesting, solve some riddle and just have fun. For this experiment I chose “BD NET VPN”. It is freely…

Vtiger CRM <= 8.1.0 has a SQL injection vulnerability in the MailManager module.

Vtiger CRM <= 8.1.0 does not correctly check user's privileges. A low-privileged user can interact directly with the `Migration` administrative module to disable arbitrary modules in the instance.

How one security product crippled the world because of bad programming

Performing a root cause analysis & building proof-of-concept for CVE-2024-38063, a CVSS 9.8 Vulnerability In the Windows Kernel IPv6 Parser

We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.

The Jenkins team released an advisory (CVE-2024-43044) for an arbitrary file read vulnerability that allows an agent to be able to read files

Introduction There is a push to use LLMs in all aspects of software engineering, far beyond merely generating code snippets. This push includes integration with code repositories and build systems.…