Exploring the realm of insecure deserialization with some hands on challenges and exploitation...

Deep diving in the world of insecure deserialization. A vulnerability in which untrusted data is used to inflict attacks, like execute code.

Ransomware attacks have become a common threat in today’s digital age, and they can cause significant damage to individuals and organisations

The Android architecture implements different security layers that, together, enable a defense-in-depth approach. This means that the confidentiality, integrity or availability of sensitive user-data doesn't hinge on one single security measure.

Mobile phones have become an imperative portion of our daily lives. People nowadays prefer to keep every bit of information regarding personal and professional life on their mobile phones.

The workflow of Xposed framework Plugins for Android Pentesting Xposed framework Plugins for Android Pentesting helps in...

A critical path traversal vulnerability, CVE-2023-1177, was discovered in MLflow, the widely used open-source platform for managing machine learning lifecycles. The flaw allows any unauthenticated user to read arbitrary files from the server's filesystem by exploiting insufficient path validation in MLflow's model artifact handling.

On March 7, 2022, security researcher Max Kellerman disclosed Dirty Pipe, a Linux local privilege escalation vulnerability with a CVSS score of 7.8 (HIGH), along with a proof of concept demonstrating how to exploit it. The vulnerability affects the Linux Kernel and allows users with low privileges to overwrite read-only files on kernels version 5.8 and later.

A critical remote code execution vulnerability, CVE-2024-9264, was discovered in Grafana versions 11.0.x through 11.2.x. The flaw allows any authenticated user with Viewer-level permissions or higher to execute arbitrary commands and read sensitive files on the underlying server by abusing the experimental SQL Expressions feature. The vulnerability arises from insufficient sanitization of user-supplied input before it is passed to the DuckDB CLI, which Grafana invokes to run SQL against the result set returned by a data source query.