Vulnerabilities our team found and reported, from discovery to fix.
5 articles
Vulnerability disclosure
Double misconfigurations in the default CrafterCMS installation result in a critical vulnerability that allows authentication bypass, leading to administrative access and RCE
Vulnerability disclosure
An OAuth redirection-based access token leak affecting users of ONA who authenticated using Bitbucket was discovered. The attack relies on several technical details across ONA, Bitbucket, and browser behavior.
Vulnerability disclosure
Our Research Story: Unauthenticated RCE in Ametys CMS 4.7.x
Vulnerability disclosure
How our research team found a CVSS 9.3 authentication bypass in Coverity, and what happened next.
Vulnerability disclosure
A critical authorization bypass in EGroupware allows attackers to achieve remote code execution through arbitrary file upload and file read primitives. We break down the vulnerability, exploitation chain, responsible disclosure process, and how it was fixed by the EGroupware team.
We use optional Google Analytics cookies to understand how the site is used. Nothing is sent to Google unless you allow analytics. You can change this choice at any time in our Cookies Policy.