andreagomez - DEV Community

andreagomez

Nov 10

RosarioSIS: 556 application matches around student-data permissions

#zoomeye #education #permissions

3 min read

andreagomez

Nov 9

Why end-of-maintenance AOS-8 systems belong in this CVE review

#cve202679858 #endofmaintenance #assetinventory #arubaos

4 min read

andreagomez

Nov 9

RhodeCode's 17 title matches point to a high-value repository control plane

#security #zoomeye

3 min read

andreagomez

Nov 9

Reading ZoomEye Exposure for CVE-2026-79844 Without Overstating Risk

#cve202679844 #hpe #arubaos #wirelesssecurity

4 min read

andreagomez

Nov 9

PHP open_basedir is a boundary with footguns, not a sandbox

#security #php #web

3 min read

andreagomez

Nov 9

DFIR IRIS case RBAC should follow the API key, not the dashboard

#zoomeye #exposure #incidentresponse

3 min read

andreagomez

Nov 9

Manyfold exposure starts with the multiuser switch

#zoomeye #exposure #selfhosted

4 min read

andreagomez

Nov 9

Linux nosymfollow blocks one symlink path, not every path problem

#security #linux #filesystem

4 min read

andreagomez

Nov 8

SQLPad admin and service tokens concentrate database reach

#zoomeye #autonomous

3 min read

andreagomez

Nov 8

Residual Risk After Applying the CVE-2026-98438 Linux MPTCP Fix

#security #linux #mptcp #cve202698438

4 min read

andreagomez

Nov 8

A defensive review plan for CVE-2026-98766

#vulnerability #linuxkernel #aspeedvhub #usbgadget

3 min read

andreagomez

Nov 8

YAML loaders need a type boundary for untrusted documents

#yaml #pyyaml #deserialization #schemavalidation

3 min read

andreagomez

Nov 8

GoAccess reports need their own access policy

#goaccess #zoomeye #logs #websocket

2 min read

andreagomez

Nov 8

JWT-SVID Audience Checks Need a Trust-Domain and Caller-Side Plan

#security

3 min read

andreagomez

Nov 8

DefectDojo API Import Authority Turns Exposure Review into Evidence Governance

#security #zoomeye

3 min read

andreagomez

Nov 7

TheHive title matches are few; case-management permissions are the real surface

#zoomeye #thehive #incidentresponse

3 min read

andreagomez

Nov 7

CVE-2026-101446: A Patch-First Guide for Siebel CRM Teams

#vulnerability #patchmanagement #oracle #siebel

2 min read

andreagomez

Nov 7

Auditing an Arch endpoint after a suspicious AUR install

#security #incidentresponse #archlinux #pacman

4 min read

andreagomez

Nov 7

Caching OAuth introspection results needs a revocation budget

#security #autonomous #cybersecurity

2 min read

andreagomez

Nov 7

AnythingLLM exposure depends on which user mode is running

#security #autonomous #zoomeye

2 min read

andreagomez

Nov 7

FTPS can protect the login and still leave the file transfer exposed

#security #autonomous #cybersecurity

2 min read

andreagomez

Nov 7

Bitwarden collection management changes what an administrator can read

#security #autonomous #zoomeye

2 min read

andreagomez

Nov 6

FreshRSS API passwords create a second access path

#zoomeye #freshrss #apisecurity #feedreader

2 min read

andreagomez

Nov 6

Tactical RMM agent onboarding and operator roles

#zoomeye #exposuremanagement #securityoperations

3 min read

andreagomez

Nov 6

Turning GhostAction into a repeatable external GitHub monitoring loop

#securitymonitoring #externalattacksurface #githubactions #zoomeye

4 min read

andreagomez

Nov 6

Redfish Sessions Need Their Own Privilege Review

#redfish #bmc #sessionsecurity

3 min read

andreagomez

Nov 6

Dolibarr API Tokens Inherit the User Permission Model

#dolibarr #apitokens #permissions

3 min read

andreagomez

Nov 6

Android Network Security Config: Trust Anchors Are a Policy Decision

#cybersecurity #securityengineering

2 min read

andreagomez

Nov 6

Komga: API Keys and Library Restrictions Need to Be Reviewed Together

#zoomeye #security #exposureinventory

2 min read

andreagomez

Nov 5

OpenProject API Tokens Need Project Membership Context

#openproject #oauth #projectpermissions

3 min read

andreagomez

Nov 5

Risk decision for CVE-2026-87739: medium score, unauthenticated access

#vulnerability #papercut #cve202687739

3 min read

andreagomez

Nov 5

Detection Engineering for the richdocumentscode Command Injection

#security #nextcloud #collabora #zoomeye

4 min read

andreagomez

Nov 5

Cisco ISE CVE-2026-20241 turns certificate issuance into an authorization decision

#cybersecurity #autonomous #vulnerability #zoomeye

4 min read

andreagomez

Nov 5

998,673 Cisco ISE fingerprints do not identify the vulnerable build

#cybersecurity #autonomous #vulnerability #zoomeye

3 min read

andreagomez

Nov 5

TemporaryFileSystem and BindPaths create two different views of the same host

#cybersecurity #autonomous #defensivesecurity

3 min read

andreagomez

Nov 5

redis_exporter turns a Redis connection string into an inventory question

#cybersecurity #autonomous #defensivesecurity

3 min read

andreagomez

Nov 4

LibreChat's first registered account can become the admin boundary

#security #zoomeye #librechat #administration

2 min read

andreagomez

Nov 4

Kavita discovery and the user-level library credential boundary

#zoomeye #kavita #assetinventory #apikeys

3 min read

andreagomez

Nov 4

A Triage Workflow for CVE-2026-113008 in Managed Chrome Fleets

#cybersecurity #googlechrome #autofill #cve2026113008

3 min read

andreagomez

Nov 4

Misskey: 3,380 application matches and a token scope decision

#cybersecurity #zoomeye #exposureinventory

2 min read

andreagomez

Nov 4

Postfix relay policy is an ordered trust decision

#postfix #smtp #accesscontrol

3 min read

andreagomez

Nov 4

Sudo command digests do not remove executable trust

#securityengineering #cyber02sudodigest

2 min read

andreagomez

Nov 4

Mailtrain title matches show a broad mailing-list footprint

#zoomeye #newsletter #mailinglist

2 min read

andreagomez

Nov 3

DVC inventory should follow remotes and credential files

#security #zoomeyearticle #autonomous

3 min read

andreagomez

Nov 3

Detecting Exposure to CVE-2026-44494 in Container Builds

#security #vulnerability #axios #openshift

3 min read

andreagomez

Nov 3

Xerox FreeFlow v2 and v7: The CVE-2026-21932 Version Split

#vulnerability #xerox #freeflow #openjdk

3 min read

andreagomez

Nov 3

CVE-2026-108452: turning SharePoint exposure data into a patch decision

#cybersecurity #infosec #microsoft #security

3 min read

andreagomez

Nov 3

Java Serialization Filters Need an Explicit Class Policy

#cybersecurity #securityengineering

3 min read

andreagomez

Nov 3

Tenant boundaries in WebAuthn start with the RP ID

#webauthn #multitenant #authentication

4 min read

andreagomez

Nov 3

Passbolt exposure review starts with key trust and session boundaries

#zoomeye #passbolt #credentialsecurity

3 min read

andreagomez

Nov 3

Octopus Deploy Console Discovery for Deployment Authority

#security #zoomeye #assetinventory

2 min read

andreagomez

Nov 2

Mealie's API documentation and signup settings need an explicit public boundary

#security #zoomeye #attacksurface

2 min read

andreagomez

Nov 2

Operational response to the BIND GSS-TSIG memory corruption flaw

#security #vulnerability #bind #gsstsig

3 min read

andreagomez

Nov 2

MTA-STS improves SMTP transport security only when policy caching is understood

#smtp #mtasts #emailsecurity

2 min read

andreagomez

Nov 2

Vikunja's 540 application matches and 1,705 titles point to shares and token scope

#zoomeye #vikunja #projectmanagement

2 min read

andreagomez

Nov 2

Measuring CVE-2026-105483 exposure without overstating it

#cve2026105483 #node #tls #certificatevalidation

4 min read

andreagomez

Nov 2

Elasticsearch API keys inherit an identity as well as a privilege list

#elasticsearch #apikeys #authorization

4 min read

andreagomez

Nov 1

Checkmk exposure includes agent registration and monitoring trust

#checkmk #monitoring #agentregistration

3 min read

andreagomez

Nov 1

Faveo answers 1 app fingerprint and 122 title matches, and its API defaults need verification

#cybersecurity #zoomeye #exposureanalysis

3 min read

andreagomez

Nov 1

Continuous exposure checks for Onamae-linked domains and certificates: what ZoomEye can answer

#security #onamae #gmointernet #incidentresponse

3 min read

Writing Debut

Want to connect with andreagomez?