🕵️ RESEARCH & DEEP DIVES
Threat Matrix: Mapping threats across cloud web applications — Microsoft Security Blog
Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive pa... — CVE ThreatInt
Rizwan17 inventory-management-system List DBOperation.php cross site scriptin... — CVE ThreatInt
Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.add... — CVE ThreatInt
Open WebUI: Any authenticated user can hang the server via a cyclic chat mess... — CVE ThreatInt
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalida... — CVE ThreatInt
Path traversal in Pandora archive extractor allows arbitrary file writes outs... — CVE ThreatInt
Open WebUI: Any authenticated user can hang the server via message deletion i... — CVE ThreatInt
Open WebUI: Any authenticated user can reach the Azure platform channel via s... — CVE ThreatInt
Open WebUI: Non-admin users can delete admin-owned external knowledge connect... — CVE ThreatInt
Rizwan17 inventory-management-system manage.php update_record sql injectionA ... — CVE ThreatInt
Open WebUI: Any authenticated user can inject chats into another user's folde... — CVE ThreatInt
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright w... — CVE ThreatInt
Open WebUI: Same-origin XSS to account takeover via terminal port-preview ifr... — CVE ThreatInt
Open WebUI: Channel members can overwrite another member's message via the ch... — CVE ThreatInt
Open WebUI: Inaccessible knowledge bases are exposed through the built-in kno... — CVE ThreatInt
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subj... — CVE ThreatInt
Path Traversal in Fortra's GoAnywhere MFT EndpointIn versions prior to 7.10.2... — CVE ThreatInt
Open WebUI: A user's session cookies are sent to tool servers configured for ... — CVE ThreatInt
Open WebUI: Admin demoted through SSO role sync keeps read and write access t... — CVE ThreatInt
Open WebUI: Any authenticated user can start a non-terminating request via a ... — CVE ThreatInt
Smashing Security podcast #484: How websites are tracking you with silence — Graham Cluley
Quantum computing company IonQ estimates that today's top quantum computers could crack Bitcoin's encryption in under... — @campuscodi@mastodon.social
Microsoft has spotted a complex phishing campaign hitting corporate environments using "fix your passkey" type of lures. — @campuscodi@mastodon.social
How to Catch an AI SOC Analyst Bluffing — securityboulevard.com (discovered)
Get to Know Our VP of Sales, EMEA: Q&A with Stewart Gregory — securityboulevard.com (discovered)
Iran-linked hackers claim North Texas outage as AT&T points to cable theft https://www. — @metacurity@infosec.exchange