exploresecurity

IT security miscellany, commentary and curiosities || the geeky alter ego of @MrJeromeSmith || thoughts are my own (who else's would they be?)

[exploresecurity @exploresecurity]

SQLi despite 'secure' Prepared Statements! Known to affect mysql and mysql2, nice write-up from @xoreipeip (and with due credit to previous work by other researchers)

[Mantra Information Security @MantraInfoSec]

Check out our new blogpost: Prepared Statements? Prepared to Be Vulnerable.

https://t.co/vH9EQbbKun

[exploresecurity @exploresecurity]

@Grazitti you might want to reword this response; bit harsh I thought 😆

[exploresecurity @exploresecurity]

2 instances this week of OAuth SaaS integrations where the setup guide says "login as admin". Even with scopes, the connections are overprivileged. Getting flashbacks of software that "needs" to be installed as admin (translation: cos then it just works).

[exploresecurity @exploresecurity]

As a #Salesforce admin or security pro, does it frustrate you that it's impossible to configure an account to have full access to the config of a Salesforce Org as read-only? Upvote https://t.co/cx9b5zVYRy

[exploresecurity @exploresecurity]

Interesting compromise of Cyberhaven's Chrome extension with a malicious OAuth app using a genuine OAuth flow https://t.co/upccOQW1Z2

[AmberWolf @AmberWolfSec]

All I want for Christmas is U(RL handlers not vulnerable to RCE)...

AmberWolf has published information about CVE-2024-12908, a Remote Code Execution vulnerability in the Delinea Secret Server Protocol Handler.

You can read our blog & PoC here:
https://t.co/oW4E5V4KFT

[exploresecurity @exploresecurity]

More awesome work from @buffaloverflow and @johnnyspandex

[AmberWolf @AmberWolfSec]

Today, AmberWolf released two blog posts and our tool "NachoVPN" to target vulnerabilities in major VPNs, including CVE-2024-29014 (SonicWall NetExtender SYSTEM RCE) and CVE-2024-5921 (Palo Alto GlobalProtect RCE and Priv Esc), after our SANS HackFest presentation.🧵

[exploresecurity @exploresecurity]

New @Sonos app - yuk. Key features missing. Maybe I've just not found things like how to edit the queue. Best case, unintuitive UI; worst case, something that worked (mostly - has definitely got buggier and slower recently) is undeniably worse. Trust that updates are coming...

[exploresecurity @exploresecurity]

The @Yourallypally steward in this story should be congratulated - he followed protocol under pressure. So important for 'first line' staff to have a robust process to follow and to be confident sticking with it.

https://t.co/tHUu6Krej5

[exploresecurity @exploresecurity]

When there seems to be so much doom and gloom around, this story of innovation + determination + dedication is a ray of hope

[Jerome Smith @MrJeromeSmith]

Saw this on @BBCLookEast - congrats to all involved including @WeAreRSGroup

[exploresecurity @exploresecurity]

A lot of people will be forgetting @evernote now. I only store text (more or less). I appreciate they have costs and I'd be prepared to bung them a few quid but this drastic change without warning will push many to find an alternative.

[Luke Rogerson @NullMode_]

@exploresecurity @evernote Have to say I forgot all about evernote as a thing

[exploresecurity @exploresecurity]

Poor show @evernote - used to be able to export all notebooks at once for back-up, now it seems I have to export each notebook in turn. Why make something so important harder to do?

[exploresecurity @exploresecurity]

@AppOmniSecurity Interesting stuff but I'm unclear if the core vulnerability and analysis was done by someone else. Can't see a source credited so maybe it is original. Could you clarify?

[The Hacker News @TheHackersNews]

🚨 Urgent Update: #Google has released a Chrome update to patch a new high-severity zero-day #vulnerability (CVE-2023-5217) that is being exploited in the wild.

Read: https://t.co/LJNdD2BJHi

#infosec #cybersecurity #informationsecurity

[exploresecurity @exploresecurity]

Great day @BsidesCambs - nice job everyone

[exploresecurity @exploresecurity]

Calling all infosec students near #Glasgow #DC44141 - a worthy cause and potentially more than a warm glow in return

[exploresecurity @exploresecurity]

Some fun with AI (trailer at https://t.co/fbyO8EjoHa)

[Spencer Brown @thespencerbrown]

OUT TODAY!!!!! Please check out my debut feature film, TIM, which is now live on Netflix U.K.! If you like it please spread the word, rate and share - apparently these first 48 hours are incredibly important so the more views we can get the better! #timmovie #Netflix #premiere

[exploresecurity @exploresecurity]

As usual from @PortSwiggerRes and @albinowax, it's not just the theory but the accompanying resources which support the practice - nice job!

[PortSwigger Research @PortSwiggerRes]

We've just published 'Smashing the state machine: the true potential of web race conditions' by @albinowax! Dive in to arm yourself with novel techniques & tooling, and help reshape this attack class:
https://t.co/GJOOn4Wmab

[BSides Cambridge @BsidesCambs]

First round of BSides Cambridge tickets are live! We've got some great talks lined up. Get your tickets now.

If you're a student, message us or @secmum and we'll sort something out.

#bsides #bsidescambs #infosec #cybereast

https://t.co/v0XQO8SOP1

[exploresecurity @exploresecurity]

Is there really no way @JustEatUK that a lost-n-found gift card can be reactivated? I assume it's expired (website only says "invalid" and have triple-checked code). Having to tweet because your "Contact us" page does no such thing.