dethos

dethos, 4 days ago to security

"CVE-2024-4367 – Arbitrary JavaScript execution in PDF.js"

https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/

#security #infosec #firefox #pdfjs #javascript

dethos, 2 months ago to security

"900 Sites, 125 million accounts, 1 vulnerability"

"""
TLDR:

• Firebase allows for easy misconfiguration of security rules with zero warnings

• This has resulted in hundreds of sites exposing a total of ~125 Million user records, including plaintext passwords & sensitive billing information
  """

https://env.fail/posts/firewreck-1/

#security #webdev #firebase #infosec

dethos, 2 months ago to security

"How to secure APIs built with Django"

https://securityboulevard.com/2024/01/best-django-security-practices/

#security #django

dethos, 2 months ago to security

"Passkeys - Threat modeling and implementation considerations"

https://slashid.com/blog/passkeys-security-implementation/

#authentication #security #webauth #passkeys

dethos, 3 months ago to python

"Happy birthday, Django accessibility team! 🌈"

"The team has been up and running for three years, and is now looking for new members."

https://www.djangoproject.com/weblog/2024/feb/10/django-accessibility-in-2023-and-beyond/

#python #django #a11y

dethos, 5 months ago to security

"Don't Believe Your Eyes - A WhatsApp Clickjacking Vulnerability"

https://00xbyte.github.io/posts/Don%27t-Believe-Your-Eyes-A-WhatsApp-Clickjacking-Vulnerability/

#security #whatsapp #clickjacking #infosec

dethos, 9 months ago to webdev

"... I accidently enabled HSTS–on localhost"

https://bartwullems.blogspot.com/2023/07/help-i-accidently-enabled-hstson.html

#hsts #webdev #security

dethos, 10 months ago to security

"Critical RCE found in popular Ghostscript open-source PDF library"

https://www.bleepingcomputer.com/news/security/critical-rce-found-in-popular-ghostscript-open-source-pdf-library/

#security #ghostscript #pdfs

dethos, 10 months ago to security

"Firefox 115 can silently remotely disable (any) extension on any site"

https://lapcatsoftware.com/articles/2023/7/1.html

#security #privacy #firefox #wtf

dethos, 1 year ago to programming Portuguese

"Respawning Malware Persists on PyPI"

https://blog.phylum.io/respawning-malware-persists-on-pypi/

#security #supplychain #python #pypi

dethos, 1 year ago to infosec

"Toyota: Car location data of 2 million customers exposed for ten years"

https://www.bleepingcomputer.com/news/security/toyota-car-location-data-of-2-million-customers-exposed-for-ten-years/

#privacy #security #cars #toyota #infosec

dethos, 1 year ago to infosec

"Testing a new encrypted messaging app's extraordinary claims"

"There's no longer any real distinction between cleartext and encrypted messages – nothing is meaningfully encrypted. For your security, you shouldn't use Converso to send any message that you wouldn't also publish as a tweet."

https://crnkovic.dev/testing-converso/

#security #messaging #infosec