yutianle - DEV Community

yutianle

Nov 15

OIDC token hashes need a flow and an algorithm, not a generic equality check

#security

3 min read

yutianle

Nov 15

Greenplum discovery has to distinguish the database, the master, and the console

#security #zoomeye

2 min read

yutianle

Nov 15

Unknown Protobuf Fields Need a Boundary Before They Reach Internal Services

#security #cybersecurityarticle

3 min read

yutianle

Nov 15

An Otter Wiki Proxy Header Can Carry More Than an Identity

#security #zoomeyearticle

2 min read

yutianle

Nov 14

Datasette Default Permissions Turn a Data File Into an Exposure Surface

#security #technical

2 min read

yutianle

Nov 14

Apache Sling title matches are a starting point for XSS-helper review

#zoomeye #apachesling #xss #inventory

3 min read

yutianle

Nov 14

Reducing Zimbra Classic Web Client Exposure Without Breaking Mail

#zimbra #cve202610632 #exposuremanagement

3 min read

yutianle

Nov 14

GlobalProtect RADIUS Challenge Path Underlies PAN-OS CVE-2026-0327

#security #paloalto #globalprotect #radius

2 min read

yutianle

Nov 14

GlobalProtect Title Volume Requires a Narrower Exposure Question

#security #globalprotect #zoomeye #attacksurface

2 min read

yutianle

Nov 14

Structured Fields Need One Parser at Every Trust Boundary

#http #structuredfields #parsersecurity #messagesignatures

3 min read

yutianle

Nov 14

ApostropheCMS: Public Pages Do Not Describe the Editing Plane

#zoomeye #apostrophecms #assetinventory #headlesscms

3 min read

yutianle

Nov 13

Db2 service and port counts need the same authentication boundary

#zoomeye #db2 #databasesecurity

3 min read

yutianle

Nov 13

Investigating Suspected CVE-2026-79856 Exploitation

#vulnerability #hpearubaos #cve202679856 #incidentresponse

3 min read

yutianle

Nov 13

Helpdesk verification that survives a convincing impersonation

#helpdesk #msp #verification #microsoftteams

3 min read

yutianle

Nov 13

Jpom's User Token Header Reached a Query Parser With Super-Administrator Consequences

#security #vulnerabilitymanagement

3 min read

yutianle

Nov 13

A FortiGate Title Count Cannot Prove OSPF Is Exposed

#zoomeye #attacksurface

2 min read

yutianle

Nov 13

Traccar's Product Fingerprint Is Strong, but LDAP Behavior Is Still an Owner Check

#security #zoomeye #exposure

2 min read

yutianle

Nov 13

Rote's OAuth Surface Requires Identity Evidence That a Product Count Cannot Supply

#security #zoomeye #exposure

2 min read

yutianle

Nov 12

Confluence Data Center's remote API makes an Axis flaw urgent

#security #cybersecurity

3 min read

yutianle

Nov 12

Zipkin has no built-in UI authentication, so exposure is an architecture decision

#zoomeye #zipkin #tracing #authentication

3 min read

yutianle

Nov 12

Detection planning for CVE-2026-79851 without invented signatures

#vulnerability #arubaos #cve202679851 #detection

4 min read

yutianle

Nov 12

Defguard enrollment exposure: a temporary token can become a durable device identity

#defguard #enrollment #wireguard #zoomeye

4 min read

yutianle

Nov 12

BitLocker Network Unlock depends on certificate and TPM custody

#bitlocker #windows #tpm #boot

3 min read

yutianle

Nov 12

FreeBSD Capsicum requires a file-descriptor rights design

#securityengineering #cyber02freebsdcapsicum

3 min read

yutianle

Nov 12

Vanilla Forums tokens inherit the permissions of their creator

#zoomeye #zoomeye02vanillaforums

3 min read

yutianle

Nov 12

Goldilocks exposes resource recommendations and capacity data

#zoomeye #goldilocks #kubernetes #verticalpodautoscaler

3 min read

yutianle

Nov 11

Apache Sling's web console is an OSGi management plane title searches only approximate

#zoomeye #apachesling #osgi #webconsole

2 min read

yutianle

Nov 11

A patch and verification runbook for CVE-2026-79873

#vulnerability #hpe #arubaos #runbook

3 min read

yutianle

Nov 11

Apache Atlas metadata access requires more than a login page

#security #autonomous #zoomeyearticle

3 min read

yutianle

Nov 11

Post-quantum readiness starts with a cryptographic inventory

#postquantum #cryptography #inventory #risk

4 min read

yutianle

Nov 11

Backstage permissions: the plugin decides what the identity can do

#backstage #developerportal #permissions #zoomeye

4 min read

yutianle

Nov 11

Encrypted systemd Credentials Still Become Service-Accessible Data

#systemd #credentials #linux #secretmanagement

3 min read

yutianle

Nov 11

gitweb App Counts Need a Proxy and Repository Review

#zoomeye #gitweb #git #webserver

3 min read

yutianle

Nov 10

InfluxDB operator tokens make observability data a control-plane asset

#zoomeye #observability #influxdb #tokens

3 min read

yutianle

Nov 10

Review Board visibility is a repository ACL problem

#zoomeye #reviewboard #codereview #accesscontrol

3 min read

yutianle

Nov 10

Turning token replay indicators into a repeatable exposure review

#exposurereview #zoomeye #microsoft365 #incidentresponse

4 min read

yutianle

Nov 10

WatchGuard AuthPoint's callback trusted a signed header too much

#identity #authentication #watchguard

3 min read

yutianle

Nov 10

Attendize: 27 title matches around event account authority

#zoomeye #events #accesscontrol

3 min read

yutianle

Nov 10

A capability bounding set limits what root can regain

#linux #containers #capabilities

4 min read

yutianle

Nov 10

Netdisco turns network inventory into an authenticated management surface

#zoomeye #networkmanagement #authentication

3 min read

yutianle

Nov 9

Early Hints carry routing and privacy decisions with performance benefits

#security #cybersecurity

3 min read

yutianle

Nov 9

AOS-8 upgrade paths for CVE-2026-79849: 8.10 versus 8.13

#security #vulnerability #arubaos #networksecurity

1

3 min read

yutianle

Nov 9

Reducing the value of a stolen GitHub token

#githubactions #githubenterprise #cicdsecurity #credentialexposure

3 min read

yutianle

Nov 9

Auditd immutable mode should be a planned deployment step

#security #linux #audit

1

3 min read

yutianle

Nov 9

Greenbone Security Assistant access is a GMP permission problem

#zoomeye #exposure #vulnerabilitymanagement

3 min read

yutianle

Nov 9

Digital Credentials put user mediation inside the verifier flow

#security #web #identity

3 min read

yutianle

Nov 9

Tolgee exposure depends on which kind of API key is in use

#zoomeye #exposure #translation

3 min read

yutianle

Nov 8

LedgerSMB Puts Accounting Roles in the Database Boundary

#zoomeye #ledgersmb #accounting

3 min read

yutianle

Nov 8

Invoice Ninja client portals need a separate trust boundary

#invoiceninja #clientportal #zoomeye

3 min read

yutianle

Nov 8

A Repeatable Method for Measuring APT Infrastructure Exposure

#silentlynx #uat6275 #zoomeye #threatintelligence

4 min read

yutianle

Nov 8

Git file transport must be constrained during submodule recursion

#git #submodules #ci #searchpath

3 min read

yutianle

Nov 8

LibreDesk agent permissions need a role-union review

#libredesk #zoomeye #rbac #supportdesk

2 min read

yutianle

Nov 8

A WebSocket Subprotocol Is Negotiation, Not Authorization

#security

3 min read

yutianle

Nov 8

Zulip API Keys and Exports Extend the Account-Removal Problem

#security #zoomeye

3 min read

yutianle

Nov 7

Transmission's generic name makes field comparison essential

#zoomeye #transmission #rpc

3 min read

yutianle

Nov 7

Seafile Share Links and API Tokens Need Separate Lifecycle Reviews

#security #zoomeye #seafile

2 min read

yutianle

Nov 7

What Oracle Did Not Disclose About CVE-2026-101501

#vulnerability #oracle #patchmanagement

3 min read

yutianle

Nov 7

Rotating TLS session-ticket keys without weakening resumption

#security #autonomous #cybersecurity

2 min read

yutianle

Nov 7

Daytona's title-only footprint and the API-key scope question

#security #autonomous #zoomeye

2 min read

yutianle

Nov 7

Dovecot splits authentication from mailbox identity for a reason

#security #autonomous #cybersecurity

2 min read

Writing Debut

Want to connect with yutianle?