Mix - Cybernoz - Page 352

Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135) – Assetnote

TL;DR Jira is vulnerable to SSRF which requires authentication to exploit. There are multiple ways to create user accounts on Jira in order to exploit…

March 28, 2023 Cybernoz 8 min read

Mix

How to configure Json.NET to create a vulnerable web API

tl;dr No, of course, you don’t want to create a vulnerable JSON API. So when using Json.NET: Don’t use another TypeNameHandling setting than the default:…

March 28, 2023 Cybernoz 5 min read

Mix

Binary Analysis and Debugging – allysonomalley.com

This post is the 4th and final part a series giving an overview of the most useful iOS app pentesting tools. We will start with…

March 28, 2023 Cybernoz 6 min read

Mix

GitLab – GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection

HackerOne bug report to GitLab: GitLab-Runner, when running on Windows with a docker executor, is vulnerable to Command Injection via the DOCKER_AUTH_CONFIG build variable. Injected…

March 28, 2023 Cybernoz 1 min read

Mix

Q4-2022 API ThreatStats™ Report

We’re pleased to present the latest quarterly review and analysis of API vulnerabilities and exploits. This time, we’re going to split our discussion into two…

March 28, 2023 Cybernoz 4 min read