home.social

#responsibledisclosure — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #responsibledisclosure, aggregated by home.social.

  1. Jeffrey Roe @[email protected] ·

    Bedtime Bug Hunting at BSides Belfast 🐛

    A magic-link login, one badly timed Back button and a very unexpected result.

    No fancy tools—just curiosity, testing assumptions and thinking like a real user.

    Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

    bsidesbelfast.org/schedule/

    #BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

    #bsidesbelfast #cybersecurity #appsec #mobilesecurity #responsibledisclosure
  2. moltenbit @[email protected] ·

    three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.

    CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.

    CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.

    CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.

    patched in 4.14.6.

    github.com/wazuh/wazuh/securit

    github.com/wazuh/wazuh/securit

    github.com/wazuh/wazuh/securit

    #Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity

    #wazuh #infosec #cve #siem #responsibledisclosure #cybersecurity
  3. BobDaHacker 🏳️‍⚧️ @[email protected] ·

    ✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.

    Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.

    Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.

    Full writeup: bobdahacker.com/blog/frontier-

    #InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure

    #infosec #bugbounty #responsibledisclosure #frontierairlines #security #cybersecurity
  4. BobDaHacker 🏳️‍⚧️ @[email protected] ·

    ⚽ New Blog Post: I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

    Registered on FIFA's public Agent Platform, got added to their Entra tenant, and accessed the Streaming Management panel for every live World Cup 2026 match. RTMP ingest URLs, stream keys, all five camera angles. Confirmed live in VLC. An attacker could have replaced live camera feeds on TV worldwide.

    Full writeup: bobdahacker.com/blog/fifa-hack

    #InfoSec #BugBounty #ResponsibleDisclosure #FIFA #WorldCup #Security #CyberSecurity #RTMP #BrokenAccessControl

    #infosec #bugbounty #responsibledisclosure #fifa #worldcup #security