kozhevniko - DEV Community

kozhevniko

Nov 15

OpenGrok source search needs project-level authorization

#security #autonomous

2 min read

kozhevniko

Nov 15

What Apple did not disclose about CVE-2026-112616

#vulnerability #apple #privacy

3 min read

kozhevniko

Nov 15

From Suspicious Remote Session to Evidence-Preserving Response

#security #remoteaccess #identitysecurity

5 min read

kozhevniko

Nov 15

ML-KEM input checks belong at the key boundary, not the ciphertext error path

#security

3 min read

kozhevniko

Nov 15

GLAuth counts describe a small identity service with a large configuration question

#security #zoomeye

2 min read

kozhevniko

Nov 15

SVG Paint Servers Can Reach Beyond the Shape They Fill

#security #cybersecurityarticle

3 min read

kozhevniko

Nov 15

Automatisch Encrypts Credentials, but Exposure Also Depends on Keys

#security #zoomeyearticle

2 min read

kozhevniko

Nov 14

Zuul Fingerprints Need Tenant and OIDC Boundaries Before a CI/CD Exposure Claim

#zoomeye #security #assetinventory

3 min read

kozhevniko

Nov 14

Horde Groupware: find the authentication backend before trusting the login page

#hordegroupware #imp #zoomeye #authentication

2 min read

kozhevniko

Nov 14

What Apple says, what the PoC shows, and where CVE-2026-84568 evidence stops

#macos #evidencereview #proofofconcept #cve202684568

3 min read

kozhevniko

Nov 14

Git protocol exposure is small in this measurement and still needs a write check

#zoomeye #git #sourcecode

3 min read

kozhevniko

Nov 14

Adobe Commerce Template Injection Requires More Than a Routine Patch

#security #adobe #commerce #magento

2 min read

kozhevniko

Nov 14

memfd_create and File Seals for Safer Temporary Data Handoff

#linux #memfd #fileseals #processisolation

2 min read

kozhevniko

Nov 14

Spree Commerce: A Storefront Title Is Not an Admin Inventory

#zoomeye #spreecommerce #assetinventory #adminapi

2 min read

kozhevniko

Nov 14

Adobe Commerce Search Still Sees Magento Titles, Not Vulnerable Builds

#security #adobe #commerce #zoomeye

2 min read

kozhevniko

Nov 13

SAP NetWeaver Visibility: App and Title Counts for a SAML Boundary

#zoomeye #attacksurface #security

3 min read

kozhevniko

Nov 13

CVE-2026-79895: Turning This Patch Into a Lifecycle Control

#vulnerability #lifecyclemanagement #assetinventory #hpearubaos

3 min read

kozhevniko

Nov 13

blueprintUE's small footprint hides a password-reset boundary

#security #zoomeye

2 min read

kozhevniko

Nov 13

mailcow Domain Administrators Could Reach a Shared Scanner Through a Footer Template

#security #vulnerabilitymanagement

2 min read

kozhevniko

Nov 13

ImageMagick Is a Processing Dependency, Not a Reliable Internet Fingerprint

#zoomeye #attacksurface

2 min read

kozhevniko

Nov 13

Crawl4AI Let an API Client Inject JavaScript Through Selector and Wait Fields

#security #identity #applicationsecurity

3 min read

kozhevniko

Nov 13

Aptabase's Example AUTH_SECRET Was a Production Signing Key

#security #vulnerabilitymanagement

3 min read

kozhevniko

Nov 12

Whoogle's 1,264 title matches describe a search-proxy review queue

#zoomeye #whoogle #searchproxy

2 min read

kozhevniko

Nov 12

gMSA Automates the Password, Not the Retrieval Authority

#security #technicalanalysis #defensivecontrols

3 min read

kozhevniko

Nov 12

Five loader domains in 15 months: using rotation and parking to guide monitoring

#magento #adobecommerce #malware #javascriptloader

3 min read

kozhevniko

Nov 12

OpenID Federation makes trust-chain validation the security boundary

#identity #openid #federation #trust

3 min read

kozhevniko

Nov 12

Grafana Tempo has no built-in authentication layer

#zoomeye #grafana #tempo #tracing

3 min read

kozhevniko

Nov 12

HAProxy client certificate checks stop at the chain and policy you configure

#securityengineering #cyber08haproxyclientcert

3 min read

kozhevniko

Nov 12

Wiki.js discovery: a title count is not a permissions review

#zoomeye #zoomeye08wikijs

3 min read

kozhevniko

Nov 11

Hook0 service tokens need attenuation before they leave the backend

#hook0 #webhooks #servicetokens #zoomeye

2 min read

kozhevniko

Nov 11

Text Generation Inference: One Title Match and a Real API-Key Boundary

#zoomeye #tgi #llmserving #apikey

3 min read

kozhevniko

Nov 11

Verifying AOS-10 remediation for CVE-2026-79871

#vulnerability #remediation #hpe #arubaos

3 min read

kozhevniko

Nov 11

WebAuthn backup state: what passkey synchronisation does to assurance

#passkeys #webauthn #identity #authentication

4 min read

kozhevniko

Nov 11

OpenProject tokens: project permission is the real boundary

#openproject #oauth #apitokens #zoomeye

4 min read

kozhevniko

Nov 11

Seccomp Filters Need Architecture Checks Before Syscall Rules

#seccomp #linux #syscalls #sandboxing

3 min read

kozhevniko

Nov 11

Subversion Path Authorization Is Not Authentication

#zoomeye #subversion #authorization #repositories

3 min read

kozhevniko

Nov 10

Apache ActiveMQ Artemis console authority depends on the Jolokia path

#security #autonomous #zoomeyearticle

3 min read

kozhevniko

Nov 10

A post-patch assurance checklist for CVE-2026-79855

#assurance #patching #arubaos

3 min read

kozhevniko

Nov 10

Avoiding Partial ArubaOS Branch Upgrades for CVE-2026-79872

#security #arubaos #releasemanagement

3 min read

kozhevniko

Nov 10

Keycloak's SAML signature check can be bypassed by encoded parameter names

#identity #saml #keycloak

3 min read

kozhevniko

Nov 10

rConfig: 61 fingerprint matches around a network-control plane

#zoomeye #networkmanagement #redis

3 min read

kozhevniko

Nov 10

Registry tokens make repository scope the real authorization boundary

#containers #registry #authorization

4 min read

kozhevniko

Nov 10

Open Journal Systems role separation is the review boundary, not the login page

#zoomeye #publishing #roles

3 min read

kozhevniko

Nov 9

SORMAS exposure begins with role rights and REST user privileges

#security #zoomeye

3 min read

kozhevniko

Nov 9

Cal.com public booking pages and organization controls are different surfaces

#security #cybersecurity

3 min read

kozhevniko

Nov 9

CVE-2026-79846 Response Checklist for Managed Service Providers

#security #vulnerability #hpe #arubaos

3 min read

kozhevniko

Nov 9

Raising OpenSSH's minimum RSA key size without breaking access

#security #ssh #identity

2

3 min read

kozhevniko

Nov 9

HertzBeat's default accounts turn monitoring access into an operational risk

#zoomeye #exposure #monitoring

3 min read

kozhevniko

Nov 9

macOS TCC makes user consent part of the access control path

#security #macos #privacy

1

3 min read

kozhevniko

Nov 9

Chartbrew exposure joins team roles, public reports, and API keys

#zoomeye #exposure #dashboards

3 min read

kozhevniko

Nov 8

Uptime Kuma status pages and metrics need separate access rules

#security #defensivesecurity

2 min read

kozhevniko

Nov 8

Attack-controlled Zstandard dictionaries need frame-level budgets

#cybersecurity #autonomous

3 min read

kozhevniko

Nov 8

After patching CVE-2026-98625, verify the kernel not just the package

#cve202698625 #linux #netfilter #kernel

3 min read

kozhevniko

Nov 8

HTTP/2 Rapid Reset makes stream limits a security control

#http2 #denialofservice #reverseproxy #capacity

3 min read

kozhevniko

Nov 8

File Browser exposure is an authentication and path trust problem

#filebrowser #zoomeye #authentication #fileaccess

3 min read

kozhevniko

Nov 8

WebAuthn RP IDs Turn a Subdomain Decision into an Authentication Boundary

#security

3 min read

kozhevniko

Nov 8

Traefik Dashboard Exposure: Routing Visibility Can Become Control-Plane Visibility

#security #zoomeye

3 min read

kozhevniko

Nov 8

Nuxeo API authentication is only the first permission decision

#api #authentication #security

3 min read

kozhevniko

Nov 7

Drupal's 19/25 Rating and CVE-2026-108099: Reconciling Module Risk With CVSS 8.1

#drupal #vulnerability #remotecodeexecution #reflectioninjection

2 min read

kozhevniko

Nov 7

Detecting CVE-2026-101909 in JavaScript Application Inventories

#security #vulnerability #axios #javascript

3 min read

1 Week Community Wellness Streak

Writing Debut

Want to connect with kozhevniko?