Khang Vo (doublevkay)

another security engineer

[Thanh Nguyen @redragonvn]

We are seeking sponsors to support 03 Vietnamese students to join International Cybersecurity Challenge (IC3) held in San Diego, US. Join us in making a meaningful impact. Your generosity is greatly appreciated!❤️https://t.co/ZZX2shqZNl

[OpenSSF @openssf]

Today we're proud to announce the release of version 1.0 of SLSA 🎉 Supply-chain Levels for Software Artifacts is an OpenSSF project that provides specifications for software supply chain security, established by community expert consensus. #OSSecurity

[Verichains @Verichains]

Verichains has released a new security advisory VSA-2022-120, exposing a key extraction vulnerability in Multichain's fastMPC. Kudos to @MultichainOrg for the swift response and bug bounty.
Keep an eye out for upcoming advisories on critical attacks targeting popular MPC implementations.

https://t.co/Ip1wdyjcAK

[Khang Vo (doublevkay) @doublevkay]

@fraxken @MyUnisoft Can't wait for your sharing!

[Khang Vo (doublevkay) @doublevkay]

@liran_tal Code pilot :D

[Open Source CVEs @OpenSourceHacks]

(CVE-2022-2564): Prototype Pollution in automattic/mongoose.

https://t.co/v8QWrTCK1H

Disclosed by @doublevkay, fixed by @code_barbarian...

#opensource #CVE #bugbounty #security #vulnerability

[Khang Vo (doublevkay) @doublevkay]

@JamieSlome @huntrdev thanks, Jamie. You help me a lot!

[Khang Vo (doublevkay) @doublevkay]

I have submitted 18 reports, 9 validated, and 4 CVEs in a month. Just small things for the beginning, but yeah, glad that I end up at the #top2 leaderboard (30 days) on @huntrdev. Appreciate the #CodeQL help!

Wish you all happy hacking!😁

[Khang Vo (doublevkay) @doublevkay]

@s0nnguy3n_ @momentjs @npmjs @huntrdev Dạ em cảm ơn anh 😁

[Khang Vo (doublevkay) @doublevkay]

I have found a high severity vulnerability in @momentjs - one of the most depended-upon packages on @npmjs.

The vulnerability has been found with CodeQL, reported on @huntrdev. It is also my first #CVE, first #bugbounty, and the first GHSA credit.😄

https://t.co/c50sBmi5Ts

[Khang Vo (doublevkay) @doublevkay]

@Sudouhack @momentjs @npmjs @huntrdev I think `npm audit` could be a good entry. In the black-box case, a particular approach would be more realistic though.

[Khang Vo (doublevkay) @doublevkay]

It is a good experience with @huntr - an awesome platform for contributing security issues to the open-source community. 👍

[Khang Vo (doublevkay) @doublevkay]

@byt3bl33d3r Quick look at @snyksec db, there are over 450 malicious packages on @npmjs.