Securityengineering

👋 Sign in for the ability to sort posts by relevant, latest, or top.

johnettagaweraks

Nov 4

Nginx X-Accel-Redirect trusts the upstream response

#securityengineering #cyber03nginxxaccel

2 min read

andreagomez

Nov 4

Sudo command digests do not remove executable trust

#securityengineering #cyber02sudodigest

2 min read

OnaEiuspkz

Nov 4

Systemd encrypted credentials still need a process boundary

#securityengineering #cyber01systemdcredentials

2 min read

facilishz

Nov 4

Tomcat RemoteIpValve needs a trusted proxy boundary

#securityengineering #cyber04tomcatremoteip

3 min read

SorrelThorncroft

Nov 4

Django SECURE_PROXY_SSL_HEADER requires header stripping

#securityengineering #cyber05djangoproxyheader

2 min read

Ioneyrezende

Nov 4

OpenSSH PermitUserEnvironment moves trust into the user account

#securityengineering #cyber07opensshuserenvironment

2 min read

StarkMan

Nov 4

pam_exec environment data is not a safe secret channel

#securityengineering #cyber08pamexec

2 min read

kozhevniko

Nov 4

Express trust proxy is a hop count, not a trust policy

#securityengineering #cyber06expresstrustproxy

2 min read

jeffrey

Nov 4

Linux protected regular files and FIFOs need a policy review

#securityengineering #cyber09protectedfiles

2 min read

johnettagaweraks

Nov 3

PostgreSQL COPY PROGRAM Is a Server-Side Execution Boundary

#cybersecurity #securityengineering

2 min read

StarkMan

Nov 3

Reviewing Docker Seccomp Profiles by Capability, Not Copying One

#cybersecurity #securityengineering

3 min read

SorrelThorncroft

Nov 3

Git SSH Signatures Verify Identity Only Within a Trust File

#cybersecurity #securityengineering

3 min read

andreagomez

Nov 3

Java Serialization Filters Need an Explicit Class Policy

#cybersecurity #securityengineering

3 min read

kozhevniko

Nov 3

Unconstrained Kerberos Delegation Leaves a Reusable Ticket Trail

#cybersecurity #securityengineering

3 min read

yutianle

Nov 3

PowerShell Logging Is an Evidence Pipeline With Gaps

#cybersecurity #securityengineering

3 min read

👋 Sign in for the ability to sort posts by relevant, latest, or top.