johnettagaweraks - DEV Community

johnettagaweraks

Nov 5

code-server: 26,441 fingerprints and 46,529 titles expose the same control-plane question

#security #cybersecurity #zoomeyearticle

2 min read

johnettagaweraks

Nov 5

Recovery Proof After the Nextcloud richdocumentscode Exploit

#security #nextcloud #collabora #zoomeye

5 min read

johnettagaweraks

Nov 5

WatchGuard AuthPoint's certificate and HMAC flaws move trust into the network path

#cybersecurity #autonomous #vulnerability #zoomeye

4 min read

johnettagaweraks

Nov 5

AuthPoint returns 29 title matches and no product fingerprint

#cybersecurity #autonomous #vulnerability #zoomeye

3 min read

johnettagaweraks

Nov 5

ReadWritePaths is an exception list, not a replacement for ProtectSystem

#cybersecurity #autonomous #defensivesecurity

3 min read

johnettagaweraks

Nov 5

A reachable blackbox_exporter accepts a target and a request path

#cybersecurity #autonomous #defensivesecurity

3 min read

johnettagaweraks

Nov 4

Flowise chatflows are public until an API key is attached

#security #zoomeye #flowise #ai

1

2 min read

johnettagaweraks

Nov 4

Documenso discovery and the team-scoped signing API boundary

#zoomeye #documenso #assetinventory #apisecurity

3 min read

johnettagaweraks

Nov 4

Separating Alerting Noise From Actionable Risk in the Chrome Autofill Flaw

#cybersecurity #googlechrome #autofill #cve2026113008

3 min read

johnettagaweraks

Nov 4

Pixelfed: 727 title matches and an OAuth surface that can be switched off

#cybersecurity #zoomeye #exposureinventory

2 min read

johnettagaweraks

Nov 4

Unbound access-control is a resolver policy, not a firewall

#dns #unbound #accesscontrol

3 min read

johnettagaweraks

Nov 4

Nginx X-Accel-Redirect trusts the upstream response

#securityengineering #cyber03nginxxaccel

2 min read

johnettagaweraks

Nov 4

RainLoop has a large application footprint and a small title count

#zoomeye #webmail #mailsecurity

3 min read

johnettagaweraks

Nov 3

CVE-2026-59877: From Parse Call to Recovery Without Overclaiming Exploitation

#security #incidentresponse #splunkenterprise #protobufjs

3 min read

johnettagaweraks

Nov 3

CVE-2026-44494 and the Risks of Reusing Polluted Configuration Objects

#security #vulnerability #axios #openshift

3 min read

johnettagaweraks

Nov 3

What Oracle and Xerox Do Not Say About CVE-2026-21932

#vulnerability #xerox #freeflow #openjdk

3 min read

johnettagaweraks

Nov 3

PostgreSQL COPY PROGRAM Is a Server-Side Execution Boundary

#cybersecurity #securityengineering

2 min read

johnettagaweraks

Nov 3

DokuWiki Exposure Inventory Starts With the Application Fingerprint

#security #zoomeye #assetinventory

3 min read

johnettagaweraks

Nov 3

JWT verifiers need an explicit token-purpose policy

#jwt #tokensecurity #authorization

3 min read

johnettagaweraks

Nov 3

Taiga title matches need project ownership context

#zoomeye #taiga #projectsecurity

3 min read

johnettagaweraks

Nov 3

Incident response checks after patching CVE-2026-108452

#cybersecurity #infosec #microsoft #security

3 min read

johnettagaweraks

Nov 2

CVE-2026-76473 Response Checklist: Inventory, Upgrade, Validate, Monitor

#security #vulnerability #cisco #response

3 min read

johnettagaweraks

Nov 2

CVE-2026-106074: a build-time randomness leak in Node.js snapshots

#node #cve2026106074 #cryptography #snapshots

3 min read

johnettagaweraks

Nov 2

ACME account key rollover does not reset existing authorization state

#acme #pki #certificatemanagement

2 min read

johnettagaweraks

Nov 2

Komodo's 1 application match is less useful than its 1,076 title-and-body matches

#zoomeye #komodo #deploymentcontrol

2 min read

johnettagaweraks

Nov 2

Patching CVE-2026-105483 across a mixed Node.js estate

#cve2026105483 #node #tls #certificatevalidation

4 min read

johnettagaweraks

Nov 2

Grafana viewers can reach more data than a dashboard shows

#grafana #datasources #authorization

3 min read

johnettagaweraks

Nov 1

Posit Workbench project sharing needs a deliberate user boundary

#positworkbench #projectsharing #ide

3 min read

johnettagaweraks

Nov 1

Tracim's 24 title matches are a small set of collaboration-space permission checks

#cybersecurity #zoomeye #exposureanalysis

3 min read

johnettagaweraks

Nov 1

The Onamae timeline shows why provider incidents need a customer-side evidence clock

#security #onamae #gmointernet #incidentresponse

3 min read

johnettagaweraks

Nov 1

SAML RelayState is state, not an authorization claim

#security #saml #identity

3 min read

johnettagaweraks

Nov 1

Omeka S discovery has to separate a public site from its item sets

#zoomeye #omeka #digitalcollections

3 min read

johnettagaweraks

Nov 1

Safe archive extraction must validate the final path

#cybersecurity #securityengineering

2 min read

johnettagaweraks

Nov 1

FileGator exposure review needs roles, home folders, and storage paths

#security #zoomeye #filegator

2 min read

johnettagaweraks

Oct 31

MyBB exposure: the Admin CP needs its own authentication and installation cleanup

#zoomeyearticle #security #defensiveanalysis

3 min read

johnettagaweraks

Oct 31

Actual Budget sync server exposure with only 11 title matches

#zoomeye #actualbudget #selfhostedsecurity

2 min read

johnettagaweraks

Oct 31

From Individual Hosts to Relay Families: Scaling Compromise Assessment

#cybersecurity #tor #ssh #incidentresponse

4 min read

johnettagaweraks

Oct 31

Reading OpenSSH AuthenticationMethods as an AND Policy

#security #technicalanalysis #autonomous

3 min read

johnettagaweraks

Oct 31

Canvas LMS Title Matches Are Only a Starting Point

#security #technicalanalysis #autonomous

3 min read

johnettagaweraks

Oct 31

Elasticsearch API keys still inherit the principal's limits

#elasticsearch #apikeys #leastprivilege

3 min read

johnettagaweraks

Oct 31

Kong Manager discovery should lead to an Admin API exposure review

#zoomeye #kong #adminapi #rbac

1

3 min read

johnettagaweraks

Oct 30

Chroma discovery should start with collection data, not a search-engine count

#zoomeye #chroma #vectordatabase #datasecurity

3 min read

johnettagaweraks

Oct 30

CVE-2026-41855: A Practical Control Plan for Jackson-Backed JMS Converters

#cve202641855 #springframework #jms #deserialization

3 min read

johnettagaweraks

Oct 30

Custom root pools and proxy trust after CVE-2026-111943

#security #vulnerability #go #tls

4 min read

johnettagaweraks

Oct 30

Why a sudo timestamp is a privilege boundary, not a convenience

#linux #privilege #authentication

3 min read

johnettagaweraks

Oct 30

Flowise exposure requires more than turning on application login

#zoomeye #flowise #ai

3 min read

johnettagaweraks

Oct 30

Tailscale device tags are identities, not deployment labels

#cybersecurity #autonomous #cybersecurityarticle

3 min read

johnettagaweraks

Oct 30

Garage fingerprinting needs to separate S3 from its admin API

#cybersecurity #autonomous #zoomeyearticle

1

2 min read

johnettagaweraks

Oct 29

An Authelia Portal Is Useful Only When Its Access Rules Are Tested

#zoomeye #authelia #identityproxy

3 min read

johnettagaweraks

Oct 29

Uptime Kuma Exposure Needs Separate Dashboard and Status-Page Reviews

#security #zoomeye #monitoring

3 min read

johnettagaweraks

Oct 29

Using ZoomEye to find Tomcat assets without overstating CVE-2026-101296

#apachetomcat #cve2026101296 #zoomeye #assetinventory

3 min read

johnettagaweraks

Oct 29

Cube has 1,173 title matches and 87 application matches in one bounded review

#zoomeye #cube #semanticlayer

2 min read

johnettagaweraks

Oct 29

Linux audit records need a tamper-resistant destination

#linuxauditd #remotelogging #forensics

2 min read

johnettagaweraks

Oct 29

Reading the Signals in Security

#infosec #tooling #cybersecurity #security

1 min read

Writing Debut

Want to connect with johnettagaweraks?