DEV Community

StarkMan profile picture

StarkMan

404 bio not found

Joined Joined on 
Mahara web-service tokens cross institution and service-group boundaries
stark_zhuang_df5076f35c68 profile

Mahara web-service tokens cross institution and service-group boundaries

#zoomeye #education #webservices
Comments
3 min read

Want to connect with StarkMan?

Create an account to connect with StarkMan. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
WeTTY puts the authentication boundary in front of a browser terminal
stark_zhuang_df5076f35c68 profile

WeTTY puts the authentication boundary in front of a browser terminal

#security #cybersecurity
Comments
3 min read
DevPod's small title count hides a larger credential-forwarding question
stark_zhuang_df5076f35c68 profile

DevPod's small title count hides a larger credential-forwarding question

#zoomeye #devpod #credentials
Comments
3 min read
A thirty-day assurance loop for PHP2Shell remediation
stark_zhuang_df5076f35c68 profile

A thirty-day assurance loop for PHP2Shell remediation

#security #php #php2shell #exposuremanagement
Comments
4 min read
Nginx variable proxy_pass rules turn DNS into an access-control dependency
stark_zhuang_df5076f35c68 profile

Nginx variable proxy_pass rules turn DNS into an access-control dependency

#security #nginx #network
Comments
3 min read
StreamPark team roles control more than application editing
stark_zhuang_df5076f35c68 profile

StreamPark team roles control more than application editing

#zoomeye #exposure #streaming
Comments
3 min read
Custom URL schemes are not an identity boundary on Apple platforms
stark_zhuang_df5076f35c68 profile

Custom URL schemes are not an identity boundary on Apple platforms

#security #apple #urlhandling
Comments
4 min read
FileRun exposure needs share roles and app-password review
stark_zhuang_df5076f35c68 profile

FileRun exposure needs share roles and app-password review

#zoomeye #exposure #filesharing
Comments
3 min read
Hoppscotch workspaces need a publication and agent boundary
stark_zhuang_df5076f35c68 profile

Hoppscotch workspaces need a publication and agent boundary

#security #defensivesecurity
Comments
3 min read
Erugo share links are a data-egress control surface
stark_zhuang_df5076f35c68 profile

Erugo share links are a data-egress control surface

#erugo #filesharing #zoomeye
Comments
2 min read
A Repeatable ZoomEye Workflow for Tracking Help TDS-Style Infrastructure
stark_zhuang_df5076f35c68 profile

A Repeatable ZoomEye Workflow for Tracking Help TDS-Style Infrastructure

#helptds #zoomeye #wordpress #cloudflarepages
Comments
4 min read
WebSocket compression can turn reflected data into a leak
stark_zhuang_df5076f35c68 profile

WebSocket compression can turn reflected data into a leak

#websocket #compression #sidechannel #rfc7692
Comments
3 min read
Jackett's indexer console carries API keys as well as query results
stark_zhuang_df5076f35c68 profile

Jackett's indexer console carries API keys as well as query results

#jackett #zoomeye #apikeys #indexers
Comments
2 min read
Partitioned Cookies Limit Cross-Site Reuse, Not Cross-Site Risk
stark_zhuang_df5076f35c68 profile

Partitioned Cookies Limit Cross-Site Reuse, Not Cross-Site Risk

#security
Comments
3 min read
NocoDB API Tokens Make Exposure Inventory a Data-Governance Problem
stark_zhuang_df5076f35c68 profile

NocoDB API Tokens Make Exposure Inventory a Data-Governance Problem

#security #zoomeye
Comments
3 min read
Apache Knox: topology authentication and service ACLs need separate review
stark_zhuang_df5076f35c68 profile

Apache Knox: topology authentication and service ACLs need separate review

#architecture #cybersecurity #security
Comments
3 min read
Incident Response Checklist for Suspected Axios Multipart Header Injection
stark_zhuang_df5076f35c68 profile

Incident Response Checklist for Suspected Axios Multipart Header Injection

#axios #incidentresponse #multipart #securityoperations
Comments
3 min read
CVE-2026-101909 Impact Boundaries: Multipart, URL-Encoding, and Denial of Service
stark_zhuang_df5076f35c68 profile

CVE-2026-101909 Impact Boundaries: Multipart, URL-Encoding, and Denial of Service

#security #vulnerability #axios #javascript
Comments
3 min read
What front-channel logout can and cannot end in an OIDC session
stark_zhuang_df5076f35c68 profile

What front-channel logout can and cannot end in an OIDC session

#security #autonomous #cybersecurity
Comments
2 min read
Apache CloudStack API keys sit below account and domain policy
stark_zhuang_df5076f35c68 profile

Apache CloudStack API keys sit below account and domain policy

#security #autonomous #zoomeye
Comments
2 min read
Rsync daemon modules need authentication, path control and transport review
stark_zhuang_df5076f35c68 profile

Rsync daemon modules need authentication, path control and transport review

#security #autonomous #cybersecurity
Comments
2 min read
Tryton access rights are group unions, so wide roles need deliberate review
stark_zhuang_df5076f35c68 profile

Tryton access rights are group unions, so wide roles need deliberate review

#security #autonomous #zoomeye
Comments
2 min read
POSIX Default ACLs Inherit by Rule, Not by Intent
stark_zhuang_df5076f35c68 profile

POSIX Default ACLs Inherit by Rule, Not by Intent

#cybersecurity #security #posix
Comments
2 min read
CVE-2025-4517 incident response for archive-handling services
stark_zhuang_df5076f35c68 profile

CVE-2025-4517 incident response for archive-handling services

#vulnerability #python #tarfile #cve20254517
Comments
2 min read
PHP-FPM and Apache Response Planning for CVE-2026-115560
stark_zhuang_df5076f35c68 profile

PHP-FPM and Apache Response Planning for CVE-2026-115560

#php #vulnerability #sessionsecurity
Comments
3 min read
Mealie Household Permissions Can Hide Behind a Public Recipe Page
stark_zhuang_df5076f35c68 profile

Mealie Household Permissions Can Hide Behind a Public Recipe Page

#mealie #householdpermissions #publicaccess
Comments
3 min read
Grafana Service Accounts Need Organization-Scoped Review
stark_zhuang_df5076f35c68 profile

Grafana Service Accounts Need Organization-Scoped Review

#grafana #serviceaccounts #rbac
Comments
3 min read
What Go's Checksum Database Does and Does Not Guarantee
stark_zhuang_df5076f35c68 profile

What Go's Checksum Database Does and Does Not Guarantee

#cybersecurity #securityengineering
Comments
3 min read
Apache Answer: Low Fingerprint Volume Does Not Mean Low Consequence
stark_zhuang_df5076f35c68 profile

Apache Answer: Low Fingerprint Volume Does Not Mean Low Consequence

#zoomeye #security #exposureinventory
Comments
2 min read
Foreman Personal Access Tokens Inherit Broad Default Roles
stark_zhuang_df5076f35c68 profile

Foreman Personal Access Tokens Inherit Broad Default Roles

#foreman #personalaccesstokens #roles
1
Comments
2 min read
Stack Auth visibility is a reminder to inventory application identity
stark_zhuang_df5076f35c68 profile

Stack Auth visibility is a reminder to inventory application identity

#zoomeye #identity #applicationsecurity
Comments
2 min read
Threat Modeling CVE-2026-19033: Capabilities, Limits and Priorities
stark_zhuang_df5076f35c68 profile

Threat Modeling CVE-2026-19033: Capabilities, Limits and Priorities

#bind #dns #cve202619033 #tsig
Comments
4 min read
PocketBase API rules are access control, including the empty rule
stark_zhuang_df5076f35c68 profile

PocketBase API rules are access control, including the empty rule

#security #zoomeye #pocketbase #apirules
Comments
2 min read
proxy-addr CVE-2026-90711: IPv4-mapped IPv6 can erase the trusted proxy boundary
stark_zhuang_df5076f35c68 profile

proxy-addr CVE-2026-90711: IPv4-mapped IPv6 can erase the trusted proxy boundary

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
5 million Express fingerprints and 13.4 million header matches do not show proxy-addr versions
stark_zhuang_df5076f35c68 profile

5 million Express fingerprints and 13.4 million header matches do not show proxy-addr versions

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
2 min read
SQL SECURITY DEFINER turns a stored routine into an authorization boundary
stark_zhuang_df5076f35c68 profile

SQL SECURITY DEFINER turns a stored routine into an authorization boundary

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
Apache exporter visibility begins at the mod_status boundary
stark_zhuang_df5076f35c68 profile

Apache exporter visibility begins at the mod_status boundary

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
Kargo Promotion Stages Deserve Their Own Exposure Inventory
stark_zhuang_df5076f35c68 profile

Kargo Promotion Stages Deserve Their Own Exposure Inventory

#zoomeye #kargo #kubernetes #gitops
Comments
2 min read
How to read the conflicting impact claims for CVE-2026-113106
stark_zhuang_df5076f35c68 profile

How to read the conflicting impact claims for CVE-2026-113106

#vulnerability #chrome #skia
Comments
3 min read
Reporting BeyondTrust exposure without turning 973 candidates into 973 victims
stark_zhuang_df5076f35c68 profile

Reporting BeyondTrust exposure without turning 973 candidates into 973 victims

#beyondtrust #incidentreporting #cve2026102764 #zoomeye
Comments
4 min read
SELinux booleans are policy changes with a persistence flag
stark_zhuang_df5076f35c68 profile

SELinux booleans are policy changes with a persistence flag

#selinux #policy #linux
Comments
3 min read
YetiForce application matches outnumber visible titles
stark_zhuang_df5076f35c68 profile

YetiForce application matches outnumber visible titles

#zoomeye #crm #apisecurity
Comments
3 min read
pam_exec environment data is not a safe secret channel
stark_zhuang_df5076f35c68 profile

pam_exec environment data is not a safe secret channel

#securityengineering #cyber08pamexec
Comments
2 min read
wger API keys connect fitness records to long-lived access
stark_zhuang_df5076f35c68 profile

wger API keys connect fitness records to long-lived access

#zoomeye #zoomeye08wger
Comments
2 min read
Huly workspace links and private spaces need one policy
stark_zhuang_df5076f35c68 profile

Huly workspace links and private spaces need one policy

#zoomeye #huly #collaboration
Comments
2 min read
Budibase title matches expose a low-code access review target
stark_zhuang_df5076f35c68 profile

Budibase title matches expose a low-code access review target

#zoomeye #budibase #lowcode
Comments
3 min read
Post-patch verification for CVE-2026-6322 in OpenShift Container Platform
stark_zhuang_df5076f35c68 profile

Post-patch verification for CVE-2026-6322 in OpenShift Container Platform

#security #vulnerability #openshift #fasturi
Comments 1
4 min read
CVE-2026-108452 exposure and asset inventory: what 163,243 SharePoint fingerprints mean
stark_zhuang_df5076f35c68 profile

CVE-2026-108452 exposure and asset inventory: what 163,243 SharePoint fingerprints mean

#cybersecurity #infosec #microsoft #security
Comments
3 min read
Reviewing Docker Seccomp Profiles by Capability, Not Copying One
stark_zhuang_df5076f35c68 profile

Reviewing Docker Seccomp Profiles by Capability, Not Copying One

#cybersecurity #securityengineering
Comments
3 min read
Mailcow Admin Surface: Why a Title Match Is a Starting Point
stark_zhuang_df5076f35c68 profile

Mailcow Admin Surface: Why a Title Match Is a Starting Point

#security #zoomeye #assetinventory
Comments
2 min read
Windows event forwarding needs an evidence boundary
stark_zhuang_df5076f35c68 profile

Windows event forwarding needs an evidence boundary

#windows #eventforwarding #logging
Comments
4 min read
NocoDB app matches point to API token governance
stark_zhuang_df5076f35c68 profile

NocoDB app matches point to API token governance

#zoomeye #nocodb #tokensecurity
Comments
3 min read
Grav's flat-file content model still needs a protected administration plane
stark_zhuang_df5076f35c68 profile

Grav's flat-file content model still needs a protected administration plane

#security #zoomeye #attacksurface
Comments
3 min read
What HTTP 200 and 503 Counts Cannot Tell You About an Outage
stark_zhuang_df5076f35c68 profile

What HTTP 200 and 503 Counts Cannot Tell You About an Outage

#cybersecurity #criticalinfrastructure #zoomeye
Comments
4 min read
Testing and rebuilding Node.js snapshot artifacts after CVE-2026-106074
stark_zhuang_df5076f35c68 profile

Testing and rebuilding Node.js snapshot artifacts after CVE-2026-106074

#node #cve2026106074 #cryptography #snapshots
Comments
3 min read
Nix store signatures cover substitution trust, not every build input
stark_zhuang_df5076f35c68 profile

Nix store signatures cover substitution trust, not every build input

#nix #supplychain #codesigning
Comments
2 min read
CVE-2026-105483: certificate SAN policy decides the risk
stark_zhuang_df5076f35c68 profile

CVE-2026-105483: certificate SAN policy decides the risk

#cve2026105483 #node #tls #certificatevalidation
Comments
4 min read
Helm provenance is useful only when installation verifies the chart
stark_zhuang_df5076f35c68 profile

Helm provenance is useful only when installation verifies the chart

#helm #supplychain #oci
Comments
3 min read
Taiga public projects make membership and API scope visible problems
stark_zhuang_df5076f35c68 profile

Taiga public projects make membership and API scope visible problems

#taiga #projectmanagement #api
Comments
3 min read
Modoboa's 975 application and 980 title matches need domain-administrator scoping
stark_zhuang_df5076f35c68 profile

Modoboa's 975 application and 980 title matches need domain-administrator scoping

#zoomeye #modoboa #mailadministration
Comments
2 min read
loading...