DEV Community

Ioneyrezende profile picture

Ioneyrezende

Security researcher & pentester. I write about network security, web appsec, and breaking things ethically.

Joined Joined on 
Gokapi API keys and OIDC sessions need different review paths
ioneyrezende profile

Gokapi API keys and OIDC sessions need different review paths

#security #cybersecurity
Comments
3 min read

Want to connect with Ioneyrezende?

Create an account to connect with Ioneyrezende. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8
ioneyrezende profile

Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8

#security #vulnerability #arubaos #networksecurity
Comments
3 min read
How attacker target selection changes PHP2Shell exposure priorities
ioneyrezende profile

How attacker target selection changes PHP2Shell exposure priorities

#security #php #php2shell #exposuremanagement
Comments
4 min read
Sudo's credential cache needs session-aware timestamp records
ioneyrezende profile

Sudo's credential cache needs session-aware timestamp records

#security #linux #privilege
1
Comments
3 min read
Apache ShenYu admin access needs its own trust boundary
ioneyrezende profile

Apache ShenYu admin access needs its own trust boundary

#zoomeye #exposure #apigateway
Comments
3 min read
WebUSB, WebHID, and Web Serial need an origin-level device policy
ioneyrezende profile

WebUSB, WebHID, and Web Serial need an origin-level device policy

#security #web #hardware
Comments
4 min read
SQLPage exposure is an authentication and page-authority review
ioneyrezende profile

SQLPage exposure is an authentication and page-authority review

#zoomeye #exposure #dataapps
Comments
3 min read
Gitea Actions runner registration is a CI trust decision
ioneyrezende profile

Gitea Actions runner registration is a CI trust decision

#security #defensivesecurity
Comments
3 min read
Security Onion's analyst console concentrates evidence, not just alerts
ioneyrezende profile

Security Onion's analyst console concentrates evidence, not just alerts

#cybersecurity #autonomous
Comments
3 min read
Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming
ioneyrezende profile

Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming

#helptds #zoomeye #wordpress #cloudflarepages
Comments
4 min read
Alt-Svc moves HTTP authority to a second endpoint
ioneyrezende profile

Alt-Svc moves HTTP authority to a second endpoint

#altsvc #http3 #origin #proxy
Comments
3 min read
Wizarr invitations turn media-server onboarding into an access path
ioneyrezende profile

Wizarr invitations turn media-server onboarding into an access path

#wizarr #zoomeye #invitations #sso
Comments
3 min read
Vary Is Not a Privacy Boundary for Authenticated Responses
ioneyrezende profile

Vary Is Not a Privacy Boundary for Authenticated Responses

#security
Comments 1
3 min read
Appsmith Exposure: Separate the Login Surface from the Application Data Plane
ioneyrezende profile

Appsmith Exposure: Separate the Login Surface from the Application Data Plane

#security #zoomeye
Comments
3 min read
Apache OFBiz exposure depends on security groups and CSRF policy
ioneyrezende profile

Apache OFBiz exposure depends on security groups and CSRF policy

Comments
3 min read
API Gateway Risk from Axios CVE-2026-42037
ioneyrezende profile

API Gateway Risk from Axios CVE-2026-42037

#axios #apigateway #multipart #node
Comments
3 min read
Hardening Axios formSerializer After CVE-2026-101909
ioneyrezende profile

Hardening Axios formSerializer After CVE-2026-101909

#security #vulnerability #axios #javascript
Comments
3 min read
Znuny: 1,172 Title Matches and the Web Service Session Boundary
ioneyrezende profile

Znuny: 1,172 Title Matches and the Web Service Session Boundary

#zoomeye #security #znuny
Comments
2 min read
OpenBao token policies define the real control-plane boundary
ioneyrezende profile

OpenBao token policies define the real control-plane boundary

#security #autonomous #zoomeye
Comments
2 min read
IPMI cipher suite zero turns a management interface into a trust decision
ioneyrezende profile

IPMI cipher suite zero turns a management interface into a trust decision

#security #autonomous #cybersecurity
Comments
2 min read
Headscale starts with all nodes reachable unless a policy file changes that
ioneyrezende profile

Headscale starts with all nodes reachable unless a policy file changes that

#security #autonomous #zoomeye
Comments
2 min read
AES-GCM nonce uniqueness is a deployment control
ioneyrezende profile

AES-GCM nonce uniqueness is a deployment control

#security #autonomous #cybersecurity
1
Comments
2 min read
Patch verification for CVE-2025-4517 in containers and dependencies
ioneyrezende profile

Patch verification for CVE-2025-4517 in containers and dependencies

#vulnerability #python #tarfile #cve20254517
Comments
2 min read
Session Lifecycle Review for CVE-2026-115560 in PHP Applications
ioneyrezende profile

Session Lifecycle Review for CVE-2026-115560 in PHP Applications

#php #vulnerability #sessionsecurity
Comments
3 min read
Immich Library Access Extends Beyond the Login Session
ioneyrezende profile

Immich Library Access Extends Beyond the Login Session

#immich #photolibrary #sharing
Comments
3 min read
CoreDNS Zone Transfers Need an Explicit Allowlist
ioneyrezende profile

CoreDNS Zone Transfers Need an Explicit Allowlist

#coredns #dns #zonetransfer
Comments
2 min read
NuGet Source Mapping Closes a Dependency Confusion Gap
ioneyrezende profile

NuGet Source Mapping Closes a Dependency Confusion Gap

#cybersecurity #securityengineering
Comments
2 min read
Outline API Keys: A Small Exposure Count With a Large Permission Question
ioneyrezende profile

Outline API Keys: A Small Exposure Count With a Large Permission Question

#zoomeye #security #exposureinventory
Comments
2 min read
StackStorm API Keys Carry an Effective Execution Identity
ioneyrezende profile

StackStorm API Keys Carry an Effective Execution Identity

#stackstorm #apikeys #rbac
Comments
2 min read
Statping-ng inventory starts with administrator defaults
ioneyrezende profile

Statping-ng inventory starts with administrator defaults

#zoomeye #monitoring #authentication
Comments
2 min read
FrankenPHP appears more often by runtime than by page title
ioneyrezende profile

FrankenPHP appears more often by runtime than by page title

#zoomeye #php #runtimeinventory
Comments
3 min read
Maintenance decisions after CVE-2026-98174: inventory, backports, and residual risk
ioneyrezende profile

Maintenance decisions after CVE-2026-98174: inventory, backports, and residual risk

#security #vulnerability #linux #cifs
Comments
4 min read
FreeRDP CVE-2026-121952: a malicious RDP server writes past the bitmap cache
ioneyrezende profile

FreeRDP CVE-2026-121952: a malicious RDP server writes past the bitmap cache

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
16.5 million RDP services cannot tell you which clients run vulnerable FreeRDP
ioneyrezende profile

16.5 million RDP services cannot tell you which clients run vulnerable FreeRDP

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
An nginx alias is only as safe as the location that reaches it
ioneyrezende profile

An nginx alias is only as safe as the location that reaches it

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
HAProxy metrics are useful only when the stats path is understood
ioneyrezende profile

HAProxy metrics are useful only when the stats path is understood

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
BookLore has 814 exact title matches and no application fingerprint; inventory the library, then verify identity
ioneyrezende profile

BookLore has 814 exact title matches and no application fingerprint; inventory the library, then verify identity

#security #zoomeye #booklore #digitallibrary
Comments
3 min read
Cross-origin data risk from CVE-2026-113106
ioneyrezende profile

Cross-origin data risk from CVE-2026-113106

#vulnerability #chrome #skia
Comments
3 min read
What to monitor after patching BeyondTrust supports a safer reopening
ioneyrezende profile

What to monitor after patching BeyondTrust supports a safer reopening

#beyondtrust #continuousmonitoring #cve2026102764 #zoomeye
Comments
3 min read
Psych.safe_load restricts object classes, not the data shape
ioneyrezende profile

Psych.safe_load restricts object classes, not the data shape

#ruby #yaml #deserialization
Comments
3 min read
InvenTree application and title counts nearly agree at about one thousand hosts
ioneyrezende profile

InvenTree application and title counts nearly agree at about one thousand hosts

#zoomeye #inventory #apisecurity
Comments
3 min read
OpenSSH PermitUserEnvironment moves trust into the user account
ioneyrezende profile

OpenSSH PermitUserEnvironment moves trust into the user account

#securityengineering #cyber07opensshuserenvironment
Comments
2 min read
SilverBullet authentication and dashboard access need separate checks
ioneyrezende profile

SilverBullet authentication and dashboard access need separate checks

#zoomeye #zoomeye07silverbullet
Comments
2 min read
Teable share views expose more than a table
ioneyrezende profile

Teable share views expose more than a table

#zoomeye #teable #dataexposure
Comments 1
2 min read
Appsmith title matches need a self-hosted security baseline
ioneyrezende profile

Appsmith title matches need a self-hosted security baseline

#zoomeye #appsmith #lowcode
Comments
3 min read
Reporting ad-supported exposure without inflating the breach
ioneyrezende profile

Reporting ad-supported exposure without inflating the breach

#cybersecurity #riskreporting #metrics #adtech
Comments
3 min read
Why CVE-2026-108452 crosses a SharePoint privilege boundary
ioneyrezende profile

Why CVE-2026-108452 crosses a SharePoint privilege boundary

#cybersecurity #infosec #microsoft #security
Comments
3 min read
MySQL LOCAL INFILE Reads From the Client, Not the Server
ioneyrezende profile

MySQL LOCAL INFILE Reads From the Client, Not the Server

#cybersecurity #securityengineering
Comments
3 min read
Roundcube Webmail Exposure Needs Host and Mailbox Context
ioneyrezende profile

Roundcube Webmail Exposure Needs Host and Mailbox Context

#security #zoomeye #assetinventory
Comments
2 min read
systemd hardening works only when the unit can fail safely
ioneyrezende profile

systemd hardening works only when the unit can fail safely

#linux #systemd #hardening
Comments
3 min read
Excalidraw deployments need a careful distinction between editor and collaboration service
ioneyrezende profile

Excalidraw deployments need a careful distinction between editor and collaboration service

#zoomeye #excalidraw #collaborationsecurity
Comments
3 min read
Building a Defensible Inventory for CVE-2026-21932
ioneyrezende profile

Building a Defensible Inventory for CVE-2026-21932

#vulnerability #xerox #freeflow #openjdk
Comments
3 min read
What to Preserve in the BNC Incident Record After Restoration
ioneyrezende profile

What to Preserve in the BNC Incident Record After Restoration

#cybersecurity #criticalinfrastructure #zoomeye
Comments
4 min read
Node.js randomInt cache persistence in snapshots: scope and limits
ioneyrezende profile

Node.js randomInt cache persistence in snapshots: scope and limits

#node #cve2026106074 #cryptography #snapshots
Comments
3 min read
IMA measurement and appraisal answer different integrity questions
ioneyrezende profile

IMA measurement and appraisal answer different integrity questions

#linux #ima #integrity
Comments 1
2 min read
CVE-2026-105483: when an IPv4 address is checked as a DNS name
ioneyrezende profile

CVE-2026-105483: when an IPv4 address is checked as a DNS name

#cve2026105483 #node #tls #certificatevalidation
Comments
4 min read
fs-verity detects file changes, but signatures decide whom you trust
ioneyrezende profile

fs-verity detects file changes, but signatures decide whom you trust

#linux #integrity #signatures
Comments
4 min read
Tuleap project permissions need an inventory of their own
ioneyrezende profile

Tuleap project permissions need an inventory of their own

#tuleap #projectmanagement #accesscontrol
Comments
4 min read
OpenPanel's 22 application matches sit in front of a server-wide control plane
ioneyrezende profile

OpenPanel's 22 application matches sit in front of a server-wide control plane

#zoomeye #openpanel #hostingcontrolpanel
Comments
2 min read
Questions for managed DNS providers after CVE-2026-96888
ioneyrezende profile

Questions for managed DNS providers after CVE-2026-96888

#security #vulnerability #bind #dns
Comments
3 min read
loading...