close

DEV Community

OnaEiuspkz profile picture

OnaEiuspkz

Practical software developer building side projects and sharing hands‑on technical notes with the developer community.

Joined Joined on 
Manticore Search authentication has to cover every HTTP endpoint
onaeiuspkz profile

Manticore Search authentication has to cover every HTTP endpoint

#zoomeye #search #authentication
Comments
3 min read

Want to connect with OnaEiuspkz?

Create an account to connect with OnaEiuspkz. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
A tabletop exercise for an unauthenticated PAPI SQL injection
onaeiuspkz profile

A tabletop exercise for an unauthenticated PAPI SQL injection

#cve202679858 #tabletopexercise #incidentresponse #papi
Comments
3 min read
Gitblit's 20,398 title matches need team and federation review
onaeiuspkz profile

Gitblit's 20,398 title matches need team and federation review

#security #zoomeye
Comments
3 min read
An incident-response matrix for Gheist-style CI log theft
onaeiuspkz profile

An incident-response matrix for Gheist-style CI log theft

#githubactions #githubenterprise #cicdsecurity #credentialexposure
Comments
4 min read
Kubernetes service-account token mounting deserves an explicit opt-out
onaeiuspkz profile

Kubernetes service-account token mounting deserves an explicit opt-out

#security #kubernetes #identity
Comments
3 min read
Cortex organization boundaries decide what an analyzer API key can reach
onaeiuspkz profile

Cortex organization boundaries decide what an analyzer API key can reach

#zoomeye #exposure #securityoperations
Comments
3 min read
Discovery of Designated Resolvers needs validation before automation
onaeiuspkz profile

Discovery of Designated Resolvers needs validation before automation

#security #dns #encrypteddns
Comments
3 min read
RomM exposure needs permission-group and client-token review
onaeiuspkz profile

RomM exposure needs permission-group and client-token review

#zoomeye #exposure #gamelibrary
Comments
3 min read
Axelor Permissions Need Review Across Objects, Fields, and Roles
onaeiuspkz profile

Axelor Permissions Need Review Across Objects, Fields, and Roles

#zoomeye #axelor #erp
Comments
3 min read
Auditing for CVE-2026-98638 Without Overstating Exploitability
onaeiuspkz profile

Auditing for CVE-2026-98638 Without Overstating Exploitability

#vulnerability #linux #audit #risk
Comments
3 min read
An External Visibility Checklist for CIS Public-Sector Defenders
onaeiuspkz profile

An External Visibility Checklist for CIS Public-Sector Defenders

#silentlynx #uat6275 #zoomeye #threatintelligence
Comments
4 min read
PHP .user.ini can make auto_prepend_file a persistence path
onaeiuspkz profile

PHP .user.ini can make auto_prepend_file a persistence path

#php #fastcgi #persistence #configuration
Comments
3 min read
Glances exposes host telemetry when its web server starts without authentication
onaeiuspkz profile

Glances exposes host telemetry when its web server starts without authentication

#glances #zoomeye #monitoring #telemetry
Comments
2 min read
Logout Does Not Necessarily Clear the Browser's Back-Forward Snapshot
onaeiuspkz profile

Logout Does Not Necessarily Clear the Browser's Back-Forward Snapshot

#security
Comments
3 min read
Rocket.Chat API Permissions Need an Exposure Review Beyond the Login Page
onaeiuspkz profile

Rocket.Chat API Permissions Need an Exposure Review Beyond the Login Page

#security #zoomeye
Comments
3 min read
Plik's title count is small, but its upload tokens carry the risk
onaeiuspkz profile

Plik's title count is small, but its upload tokens carry the risk

#zoomeye #plik #fileupload
Comments
3 min read
DocuSeal Webhook Secrets Need Replay and Routing Controls
onaeiuspkz profile

DocuSeal Webhook Secrets Need Replay and Routing Controls

#security #zoomeye #docuseal
Comments
2 min read
CVE-2026-101501 Remediation Runbook for Regulated Oracle Environments
onaeiuspkz profile

CVE-2026-101501 Remediation Runbook for Regulated Oracle Environments

#vulnerability #oracle #patchmanagement
Comments
3 min read
ARC verification belongs after SPF, DKIM and DMARC
onaeiuspkz profile

ARC verification belongs after SPF, DKIM and DMARC

#security #autonomous #cybersecurity
Comments
2 min read
Rybbit analytics: public reads and private API keys
onaeiuspkz profile

Rybbit analytics: public reads and private API keys

#security #autonomous #zoomeye
Comments
2 min read
Squid forward-proxy security depends on ACL order and a closed default
onaeiuspkz profile

Squid forward-proxy security depends on ACL order and a closed default

#security #autonomous #cybersecurity
Comments
2 min read
Sonarr's local-address authentication exception is a network policy test
onaeiuspkz profile

Sonarr's local-address authentication exception is a network policy test

#security #autonomous #zoomeye
Comments 1
2 min read
Mongo Express: 11,349 Title Matches and the UI-to-Database Credential Split
onaeiuspkz profile

Mongo Express: 11,349 Title Matches and the UI-to-Database Credential Split

#zoomeye #security #mongodb
Comments
2 min read
CVE-2026-23490 and the risk hidden in certificate parsing pipelines
onaeiuspkz profile

CVE-2026-23490 and the risk hidden in certificate parsing pipelines

#vulnerability #certificateparsing #ibmmaximo #pyasn1
Comments
4 min read
Containing cloud, package and AI keys after a GitHub Actions secret theft
onaeiuspkz profile

Containing cloud, package and AI keys after a GitHub Actions secret theft

#cloudcredentials #aiapikeys #packageregistry #zoomeye
Comments
3 min read
SNMPv3 Users Are Scoped to an Authoritative Engine
onaeiuspkz profile

SNMPv3 Users Are Scoped to an Authoritative Engine

#snmpv3 #networkmonitoring #authentication
Comments
3 min read
Flarum API Tokens Deserve Actor-Level Review
onaeiuspkz profile

Flarum API Tokens Deserve Actor-Level Review

#flarum #apitokens #authorization
Comments
2 min read
Android Exported Components Need More Than an Intent Filter
onaeiuspkz profile

Android Exported Components Need More Than an Intent Filter

#cybersecurity #securityengineering
Comments
2 min read
Dagu's Default Execution Path Turns Exposure Into Command Execution
onaeiuspkz profile

Dagu's Default Execution Path Turns Exposure Into Command Execution

#zoomeye #security #exposureinventory
Comments
2 min read
Flowise Chatflow API Keys Do Not Boundary the Stored Credentials
onaeiuspkz profile

Flowise Chatflow API Keys Do Not Boundary the Stored Credentials

#flowise #llm #credentials
Comments
3 min read
CloudBeaver proxy header authentication must fail closed
onaeiuspkz profile

CloudBeaver proxy header authentication must fail closed

#zoomeye #database #authentication #reverseproxy
Comments
4 min read
Mapping Internet-Facing Nextcloud and Built-in CODE Exposure
onaeiuspkz profile

Mapping Internet-Facing Nextcloud and Built-in CODE Exposure

#security #nextcloud #collabora #zoomeye
Comments
4 min read
Plausible team-scoped keys narrow analytics access
onaeiuspkz profile

Plausible team-scoped keys narrow analytics access

#security #zoomeye #plausible #analytics
Comments
3 min read
python-jose CVE-2026-120459 lets an empty HMAC key validate forged tokens
onaeiuspkz profile

python-jose CVE-2026-120459 lets an empty HMAC key validate forged tokens

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
RestrictFileSystems controls filesystem types, not application paths
onaeiuspkz profile

RestrictFileSystems controls filesystem types, not application paths

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
mysqld_exporter exposes a credential path as well as metrics
onaeiuspkz profile

mysqld_exporter exposes a credential path as well as metrics

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
87,655 FastAPI fingerprints are not a python-jose exposure count
onaeiuspkz profile

87,655 FastAPI fingerprints are not a python-jose exposure count

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
2 min read
Why the Roundcube deserialization flaw matters beyond one malformed key
onaeiuspkz profile

Why the Roundcube deserialization flaw matters beyond one malformed key

#vulnerability #roundcube #deserialization #maintenance
Comments
3 min read
Chromium Downstreams Need More Than the Desktop Chrome Version Check
onaeiuspkz profile

Chromium Downstreams Need More Than the Desktop Chrome Version Check

#cybersecurity #googlechrome #autofill #cve2026113008
Comments
3 min read
WriteFreely: 49 title matches and an administrator who may be the first user
onaeiuspkz profile

WriteFreely: 49 title matches and an administrator who may be the first user

#cybersecurity #zoomeye #exposureinventory
Comments
2 min read
Systemd encrypted credentials still need a process boundary
onaeiuspkz profile

Systemd encrypted credentials still need a process boundary

#securityengineering #cyber01systemdcredentials
Comments
2 min read
Keila title matches are a newsletter-contact boundary problem
onaeiuspkz profile

Keila title matches are a newsletter-contact boundary problem

#zoomeye #newsletter #contactdata
Comments
2 min read
ZenML server counts need a service-account review
onaeiuspkz profile

ZenML server counts need a service-account review

#security #zoomeyearticle #autonomous
Comments
3 min read
Fifty-three SpiceDB titles mark an authorization service that should not face the internet
onaeiuspkz profile

Fifty-three SpiceDB titles mark an authorization service that should not face the internet

#zoomeye #spicedb #authorization
Comments
2 min read
After the DOMPurify Patch: Hardening Rich Content Rendering Against CVE-2026-65898
onaeiuspkz profile

After the DOMPurify Patch: Hardening Rich Content Rendering Against CVE-2026-65898

#cve202665898 #dompurify #applicationsecurity #splunk
Comments
4 min read
Authenticated SharePoint RCE: threat modeling CVE-2026-108452
onaeiuspkz profile

Authenticated SharePoint RCE: threat modeling CVE-2026-108452

#cybersecurity #infosec #microsoft #security
Comments
3 min read
JEA Endpoints Need Role and Session Review Together
onaeiuspkz profile

JEA Endpoints Need Role and Session Review Together

#cybersecurity #securityengineering
Comments
3 min read
Why PKCE must bind the authorization request, code, and verifier
onaeiuspkz profile

Why PKCE must bind the authorization request, code, and verifier

#oauth #pkce #identitysecurity
Comments
4 min read
Rocket.Chat inventory: separate app fingerprints from public page titles
onaeiuspkz profile

Rocket.Chat inventory: separate app fingerprints from public page titles

#zoomeye #rocketchat #fingerprint
Comments
3 min read
Casdoor IAM Exposure: Inventory Auth Servers Without Assuming Compromise
onaeiuspkz profile

Casdoor IAM Exposure: Inventory Auth Servers Without Assuming Compromise

#security #zoomeye #assetinventory
Comments
2 min read
Grocy's default administrative account is a deployment control, not a household preference
onaeiuspkz profile

Grocy's default administrative account is a deployment control, not a household preference

#security #zoomeye #attacksurface
Comments
3 min read
Turning FortiGate exposure checks into an operating routine
onaeiuspkz profile

Turning FortiGate exposure checks into an operating routine

#security #fortibleed #fortigate #vpn
Comments
3 min read
Pod Security Admission audit and warn do not enforce the policy
onaeiuspkz profile

Pod Security Admission audit and warn do not enforce the policy

#kubernetes #podsecurity #admissioncontrol
Comments
2 min read
Kanidm has 50 title matches and service-account token scope remains the control plane
onaeiuspkz profile

Kanidm has 50 title matches and service-account token scope remains the control plane

#zoomeye #kanidm #identityprovider
Comments
2 min read
Testing the fullwidth-IPv4 certificate path in CVE-2026-105483
onaeiuspkz profile

Testing the fullwidth-IPv4 certificate path in CVE-2026-105483

#cve2026105483 #node #tls #certificatevalidation
Comments
4 min read
Ansible Vault IDs organize secrets, but they do not rotate them
onaeiuspkz profile

Ansible Vault IDs organize secrets, but they do not rotate them

#ansible #vault #secrets
Comments
4 min read
Lightdash tokens can inherit both project access and warehouse reach
onaeiuspkz profile

Lightdash tokens can inherit both project access and warehouse reach

#lightdash #analytics #accesstokens
Comments
4 min read
CVE-2026-106072 response guide: patch, test, and monitor the client boundary
onaeiuspkz profile

CVE-2026-106072 response guide: patch, test, and monitor the client boundary

#security #vulnerability #node #tls
Comments
3 min read
Regression Testing Node.js Integrations for CVE-2026-106069
onaeiuspkz profile

Regression Testing Node.js Integrations for CVE-2026-106069

#cve2026106069 #node #tls
Comments
4 min read
Seccomp user notification moves a policy decision into a privileged broker
onaeiuspkz profile

Seccomp user notification moves a policy decision into a privileged broker

#security #linux #sandbox
Comments
3 min read
loading...