DEV Community

kozhevniko profile picture

kozhevniko

Stay curious, keep researching.

Joined Joined on 
SORMAS exposure begins with role rights and REST user privileges
kozhevniko profile

SORMAS exposure begins with role rights and REST user privileges

#security #zoomeye
Comments
3 min read

Want to connect with kozhevniko?

Create an account to connect with kozhevniko. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
Cal.com public booking pages and organization controls are different surfaces
kozhevniko profile

Cal.com public booking pages and organization controls are different surfaces

#security #cybersecurity
Comments
3 min read
CVE-2026-79846 Response Checklist for Managed Service Providers
kozhevniko profile

CVE-2026-79846 Response Checklist for Managed Service Providers

#security #vulnerability #hpe #arubaos
Comments
3 min read
Raising OpenSSH's minimum RSA key size without breaking access
kozhevniko profile

Raising OpenSSH's minimum RSA key size without breaking access

#security #ssh #identity
2
Comments
3 min read
HertzBeat's default accounts turn monitoring access into an operational risk
kozhevniko profile

HertzBeat's default accounts turn monitoring access into an operational risk

#zoomeye #exposure #monitoring
Comments
3 min read
macOS TCC makes user consent part of the access control path
kozhevniko profile

macOS TCC makes user consent part of the access control path

#security #macos #privacy
Comments 1
3 min read
Chartbrew exposure joins team roles, public reports, and API keys
kozhevniko profile

Chartbrew exposure joins team roles, public reports, and API keys

#zoomeye #exposure #dashboards
Comments
3 min read
Uptime Kuma status pages and metrics need separate access rules
kozhevniko profile

Uptime Kuma status pages and metrics need separate access rules

#security #defensivesecurity
Comments
2 min read
Attack-controlled Zstandard dictionaries need frame-level budgets
kozhevniko profile

Attack-controlled Zstandard dictionaries need frame-level budgets

#cybersecurity #autonomous
Comments
3 min read
After patching CVE-2026-98625, verify the kernel not just the package
kozhevniko profile

After patching CVE-2026-98625, verify the kernel not just the package

#cve202698625 #linux #netfilter #kernel
Comments
3 min read
HTTP/2 Rapid Reset makes stream limits a security control
kozhevniko profile

HTTP/2 Rapid Reset makes stream limits a security control

#http2 #denialofservice #reverseproxy #capacity
Comments
3 min read
File Browser exposure is an authentication and path trust problem
kozhevniko profile

File Browser exposure is an authentication and path trust problem

#filebrowser #zoomeye #authentication #fileaccess
Comments
3 min read
WebAuthn RP IDs Turn a Subdomain Decision into an Authentication Boundary
kozhevniko profile

WebAuthn RP IDs Turn a Subdomain Decision into an Authentication Boundary

#security
Comments
3 min read
Traefik Dashboard Exposure: Routing Visibility Can Become Control-Plane Visibility
kozhevniko profile

Traefik Dashboard Exposure: Routing Visibility Can Become Control-Plane Visibility

#security #zoomeye
Comments
3 min read
Nuxeo API authentication is only the first permission decision
kozhevniko profile

Nuxeo API authentication is only the first permission decision

#api #authentication #security
Comments
3 min read
Drupal's 19/25 Rating and CVE-2026-108099: Reconciling Module Risk With CVSS 8.1
kozhevniko profile

Drupal's 19/25 Rating and CVE-2026-108099: Reconciling Module Risk With CVSS 8.1

#drupal #vulnerability #remotecodeexecution #reflectioninjection
Comments
2 min read
Detecting CVE-2026-101909 in JavaScript Application Inventories
kozhevniko profile

Detecting CVE-2026-101909 in JavaScript Application Inventories

#security #vulnerability #axios #javascript
Comments
3 min read
Countly: 2,612 Title Matches and the Gap Between Login and Data Access
kozhevniko profile

Countly: 2,612 Title Matches and the Gap Between Login and Data Access

#zoomeye #security #countly
Comments
2 min read
Dokku proxy exposure is an application-auth question
kozhevniko profile

Dokku proxy exposure is an application-auth question

#security #autonomous #zoomeye
Comments
2 min read
TCP-AO strengthens BGP sessions, but key lifecycle remains the hard part
kozhevniko profile

TCP-AO strengthens BGP sessions, but key lifecycle remains the hard part

#security #autonomous #cybersecurity
Comments
2 min read
Zoraxy deployments need route-level authentication, not just a hidden admin page
kozhevniko profile

Zoraxy deployments need route-level authentication, not just a hidden admin page

#security #autonomous #zoomeye
Comments
2 min read
pgaudit object coverage starts with the audit role's grants
kozhevniko profile

pgaudit object coverage starts with the audit role's grants

#security #autonomous #cybersecurity
Comments
2 min read
CVE-2025-4517: A path-length edge case with file overwrite impact
kozhevniko profile

CVE-2025-4517: A path-length edge case with file overwrite impact

#vulnerability #python #tarfile #cve20254517
Comments
2 min read
Tube Archivist small exposure counts can still mark a superuser surface
kozhevniko profile

Tube Archivist small exposure counts can still mark a superuser surface

#tubearchivist #zoomeye #superuser #forwardauthentication
Comments
3 min read
Prioritizing Node.js CVE-2026-105481 Across a Mixed Fleet
kozhevniko profile

Prioritizing Node.js CVE-2026-105481 Across a Mixed Fleet

#vulnerability #node #http #cve2026105481
Comments
4 min read
EMQX Authentication Chains Need Explicit Failure Semantics
kozhevniko profile

EMQX Authentication Chains Need Explicit Failure Semantics

#emqx #mqtt #authenticationchain
Comments
3 min read
AWX OAuth Scopes and RBAC Both Decide What Automation Can Do
kozhevniko profile

AWX OAuth Scopes and RBAC Both Decide What Automation Can Do

#awx #oauth #rbac
Comments
2 min read
S/MIME Trust Starts With the Sender, Not the Padlock
kozhevniko profile

S/MIME Trust Starts With the Sender, Not the Padlock

#cybersecurity #securityengineering
Comments
2 min read
Karakeep Crawlers Extend an SSRF Boundary Into the Internal Network
kozhevniko profile

Karakeep Crawlers Extend an SSRF Boundary Into the Internal Network

#zoomeye #security #exposureinventory
Comments
2 min read
OpenStatus status pages need an access model before publication
kozhevniko profile

OpenStatus status pages need an access model before publication

#zoomeye #statuspage #accesscontrol
Comments
2 min read
Paperless-ngx has a stable fingerprint and an expanding document surface
kozhevniko profile

Paperless-ngx has a stable fingerprint and an expanding document surface

#zoomeye #documentmanagement #permissions
Comments
3 min read
A Clinician-Facing Attack Surface Review for Quanum LSM Clients
kozhevniko profile

A Clinician-Facing Attack Surface Review for Quanum LSM Clients

#security #healthcare #zoomeye
Comments
4 min read
Dell OpenManage Enterprise CVE-2026-91909 makes argument parsing the control plane
kozhevniko profile

Dell OpenManage Enterprise CVE-2026-91909 makes argument parsing the control plane

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
Dell OpenManage Enterprise exposes no app fingerprint and only 12 title matches
kozhevniko profile

Dell OpenManage Enterprise exposes no app fingerprint and only 12 title matches

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
core.hooksPath moves executable policy outside the repository
kozhevniko profile

core.hooksPath moves executable policy outside the repository

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
snmp_exporter can turn a web request into a network-management probe
kozhevniko profile

snmp_exporter can turn a web request into a network-management probe

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
OpenHands local runtime defaults and API keys create two different exposure questions
kozhevniko profile

OpenHands local runtime defaults and API keys create two different exposure questions

#security #zoomeye #openhands #agentruntime
Comments
3 min read
Whitelabel pages are a bad Jackson inventory
kozhevniko profile

Whitelabel pages are a bad Jackson inventory

#zoomeye #springboot #jackson #dependencyinventory
Comments
3 min read
After Patching CVE-2026-113292: Verification and Residual Risk
kozhevniko profile

After Patching CVE-2026-113292: Verification and Residual Risk

#vulnerability #chrome #android #omnibox
Comments
3 min read
A TLS syslog tunnel is not authenticated until both ends verify certificates
kozhevniko profile

A TLS syslog tunnel is not authenticated until both ends verify certificates

#syslog #tls #logging
Comments
3 min read
Part-DB title matches point to a parts catalog with attached files
kozhevniko profile

Part-DB title matches point to a parts catalog with attached files

#zoomeye #inventory #assetexposure
Comments
3 min read
Express trust proxy is a hop count, not a trust policy
kozhevniko profile

Express trust proxy is a hop count, not a trust policy

#securityengineering #cyber06expresstrustproxy
Comments
2 min read
YOURLS private mode still has an API boundary
kozhevniko profile

YOURLS private mode still has an API boundary

#zoomeye #zoomeye06yourls
Comments
2 min read
Owncast: 3,117 title matches separate the stream key from the admin password
kozhevniko profile

Owncast: 3,117 title matches separate the stream key from the admin password

#cybersecurity #zoomeye #exposureinventory
Comments
2 min read
Engineering lessons from the lodash imports injection
kozhevniko profile

Engineering lessons from the lodash imports injection

#security #vulnerability #lodash #cve20264800
1
Comments
3 min read
Watching for AdFection infrastructure after the takedowns
kozhevniko profile

Watching for AdFection infrastructure after the takedowns

#cybersecurity #threatintelligence #infrastructure #takedown
Comments
3 min read
SharePoint Subscription Edition patch triage for CVE-2026-108452
kozhevniko profile

SharePoint Subscription Edition patch triage for CVE-2026-108452

#cybersecurity #infosec #microsoft #security
Comments
3 min read
Unconstrained Kerberos Delegation Leaves a Reusable Ticket Trail
kozhevniko profile

Unconstrained Kerberos Delegation Leaves a Reusable Ticket Trail

#cybersecurity #securityengineering
Comments
3 min read
Zimbra Webmail Exposure: Separate Reachable Login Pages From Affected Servers
kozhevniko profile

Zimbra Webmail Exposure: Separate Reachable Login Pages From Affected Servers

#security #zoomeye #assetinventory
Comments
2 min read
Authenticated time needs NTS deployment and monitoring
kozhevniko profile

Authenticated time needs NTS deployment and monitoring

#ntp #nts #timesecurity
Comments
3 min read
HedgeDoc note servers need session and reverse-proxy scope checks
kozhevniko profile

HedgeDoc note servers need session and reverse-proxy scope checks

#zoomeye #hedgedoc #documentationsecurity
Comments
3 min read
SeaTable Server Exposure: Locate Admin and Shared-Base Surfaces
kozhevniko profile

SeaTable Server Exposure: Locate Admin and Shared-Base Surfaces

#seatable #zoomeye #datacollaboration
Comments
2 min read
Post-Patch Verification for CVE-2026-28328: Policy, Logs and Access Reviews
kozhevniko profile

Post-Patch Verification for CVE-2026-28328: Policy, Logs and Access Reviews

#security #vulnerability #solarwinds #cve202628328
Comments
3 min read
From predictable IDs to workflow risk: analyzing Node.js CVE-2026-106074
kozhevniko profile

From predictable IDs to workflow risk: analyzing Node.js CVE-2026-106074

#node #cve2026106074 #cryptography #snapshots
Comments
2 min read
Windows App Control audit mode does not prove enforcement readiness
kozhevniko profile

Windows App Control audit mode does not prove enforcement readiness

#windows #wdac #applicationcontrol
Comments
2 min read
Invoice Ninja's 4,049 title matches hold billing data behind API and portal boundaries
kozhevniko profile

Invoice Ninja's 4,049 title matches hold billing data behind API and portal boundaries

#zoomeye #invoiceninja #billingsecurity
Comments
2 min read
Client-Cert headers only work when the proxy boundary is real
kozhevniko profile

Client-Cert headers only work when the proxy boundary is real

#http #mtls #reverseproxy
Comments
3 min read
OneDev exposure starts with project authority, not the login page
kozhevniko profile

OneDev exposure starts with project authority, not the login page

#onedev #sourcecode #cicd
Comments
4 min read
CVE-2026-105483 remediation checklist for Node.js teams
kozhevniko profile

CVE-2026-105483 remediation checklist for Node.js teams

#cve2026105483 #node #tls #certificatevalidation
Comments
4 min read
A staged upgrade plan for CVE-2026-96888 in BIND
kozhevniko profile

A staged upgrade plan for CVE-2026-96888 in BIND

#security #vulnerability #bind #dns
Comments
3 min read
loading...