ROSECURIFY
Subscribe
~/ seclog/ #117

Seclog - #117

12 curated links

g3n3r4l9

  1. GitHub Action tj-actions/changed-files supply chain attack (wiz.io)

    The widely used GitHub Action was compromised, causing affected repositories to leak secrets in logs, tracked as CVE-2025-30066. -

  2. NEW No-Click Critical Vulnerability in Microsoft Windows: CVE-2025-21298 (hackers-arise.com)

    A critical vulnerability in Microsoft Windows that doesn't require user interaction. -

  3. In-Depth Technical Analysis of the Bybit Hack (nccgroup.com)

    NCC Group provides a detailed technical breakdown of the Bybit cryptocurrency exchange hack. -

  4. PostgreSQL Exploit (offsec.com)

    OffSec details a new exploitation technique for PostgreSQL databases. -

  5. Harden-Runner detection: tj-actions/changed-files action is compromised (stepsecurity.io)

    StepSecurity's report on the compromised GitHub action and detection methods. -

  6. Bypassing Web Filters Part 1: SNI Spoofing (blog.compass-security.com)

    Compass Security explores techniques to bypass web filters using SNI spoofing. -

  7. Lingua Diabolis | Analysis of CVE-2025-24813 Apache Tomcat Path Equivalence RCE (scrapco.de)

    Detailed analysis of a remote code execution vulnerability in Apache Tomcat. -

  8. Welcome to Security Week 2025 (blog.cloudflare.com)

    Cloudflare announces its annual Security Week event for 2025. -

  9. '\\a\\l\\ert' (perplexity.ai)

    One leveraging invalid escapes - XSS payload technique using invalid escapes: parent - Go X

g1thub3

  1. akamai/CVE-2025-27636-Apache-Camel-PoC (github.com)

    Proof of concept for exploiting a vulnerability in Apache Camel. - Explore on GitHub

  2. wh1ant/vulnjs (github.com)

    A collection of vulnerable JavaScript code samples for security testing and education. - Explore on GitHub

  3. t0sche/cvss-bt (github.com)

    A tool for enriching the NVD CVSS scores to include Temporal & Threat Metrics. - Explore on GitHub

← All Seclogs