Open Source Vulnerability Assessment and Management helps developers and pentesters to perform scans and manage vulnerabilities. - archerysec/archerysec

Security vendors have a mediocre track record in keeping their own applications and infrastructure safe. As a security product company, we...

3 votes and 0 so far on reddit

On May 26th 2018, Bugcrowd held the LevelUp 0x02 conference! Watch this playlist for all of the videos from the conference.

We have been investigating methods to find and document ways to extract data from spreadsheets using out of band methods. This blog focuses on Google Sheets & LibreOffice on Linux. Using built-in functions & formula we were able to extract data from within…

ZenMate, a VPN provider with over 43 million users, offers multiple browser extensions to use their VPN with. As of the time of this writing the browser

1 votes and 0 so far on reddit

by Luka Treiber, 0patch Team In April, Steven Seeley of Source Incite published a report  of a vulnerability in Foxit Reader and P...

RichFaces is one of the most popular component libraries for JavaServer Faces (JSF). In the past, two vulnerabilities (CVE-2013-2165 and CVE...

PineSec is a"CitySec" Information Security Meetup in Manchester, New Hampshire
Our topic for June is the Internet of Insecure Things.   Bring your favorite IoT gadget to be torn apart (literally or figuratively) for our amusement.
PineSec is an informal monthly…

Some time ago I detailed PHP Object Injection vulnerabilities and this post will get into details of Java deserialization vulnerabilities. The concept is simple: developers use a feature of the pro…

IoT attacks can be classified into three levels: Level 0 (attacking device with no authentication), Level 1 (guessing a weak/default…

According to reporting of trusted third parties, HIDDEN COBRA actors have likely been using both Joanap and Brambul malware since at least 2009 to target multiple victims globally and in the United States—including the media, aerospace, financial, and critical…

This blog post explains the story behind a bug which had existed in the Steam client for at least the last ten years, and until last July would have resulted in remote code execution (RCE) in all 15 million active clients. 

Proof of Stake protocols are in the spotlight as more and more high-profile blockchains attempt to switch over from Proof of Work…