facilishz - DEV Community

facilishz

Oct 27

117,240 Metabase Fingerprints: A Dashboard Is a Doorway to the Warehouse

#metabase #businessintelligence #dataaccess #exposure

3 min read

facilishz

Oct 27

Why Nobody Has Exploited CVE-2026-110812 Yet, and Why That Should Not Set Your Timeline

#vulnerability #cve2026110812 #amazonneptune #gremlin

3 min read

facilishz

Oct 27

Verifying a VMmanager patch when no CVE was published

#security #zoomeye #vmmanager #hosting

3 min read

facilishz

Oct 27

CVE-2026-93479: A July Patch Opened the Door to a New NGINX Heap Overflow

#cybersecurity #infosec #security

3 min read

facilishz

Oct 27

Four Moderate Flaws, One Critical Chain: What the Plex2Shell Disclosure Teaches Vulnerability Research

#vulnerability #plex #rce #exposure

4 min read

facilishz

Oct 27

5,375 titles, 5 fingerprints: Planka, and what a board full of project data looks like from outside

#zoomeye #exposure #kanban #selfhosted

3 min read

facilishz

Oct 27

Where CVE-2026-111497 actually bites: decompression paths in Node.js services

#security #vulnerability #node #brotli

3 min read

facilishz

Oct 26

Four medium scores, one exploited chain: reading the Plex CVEs correctly

#vulnerability #plexmediaserver #cve202696654 #remotecodeexecution

3 min read

facilishz

Oct 26

1.77 million Nextcloud fingerprints and 1.73 million titles: the 44,000-host gap is where the affected office app lives

#zoomeye #exposure #nextcloud #collabora

4 min read

facilishz

Oct 26

Hunting for NSD exploitation attempts instead of waiting for an alert

#dns #nsd #vulnerability #cve2026101338

3 min read

facilishz

Oct 26

CVE-2026-101983: A Stack Overflow in Junos httpd Reaches the Routing Engine Through J-Web

#cybersecurity #infosec #security

4 min read

facilishz

Oct 26

CVE-2026-106931 Observability Gaps on the Web Server Itself

#vulnerability #detection #observability #webapplicationfirewall

3 min read

facilishz

Oct 26

What We Actually Know About CVE-2026-102764, and What the Numbers Do Not Say

#zoomeye #evidence #beyondtrust #analysis

3 min read

facilishz

Oct 26

An authz file is the only thing between an anonymous Subversion client and the whole repository

#security

4 min read

facilishz

Oct 26

Grist: 232 page titles, 2,189 body matches, no fingerprint, and a spreadsheet that holds the workflow

#selfhosted #authorisation #zoomeye

4 min read

facilishz

Oct 25

general_log = 1 writes every query to a file, including the passwords in them

#mysql #logging #credentialexposure #database

3 min read

facilishz

Oct 25

52,068 SonarQube pages on 9000, 12,052 fingerprints, and the tokens that sit in the project settings

#zoomeye #sonarqube #codeanalysis

3 min read

facilishz

Oct 25

Why the BlockStrap attack path runs through checkout and a failed payment email

#magento #adobecommerce #rce #cve2026103849

3 min read

facilishz

Oct 25

CVE-2026-96652: how Plex Media Server turns one request field into an outbound POST

#cybersecurity #infosec #security

3 min read

facilishz

Oct 25

Scoping PAN-OS CVE-2026-0321 exposure without overclaiming

#panos #cve20260321 #zoomeye #attacksurface

3 min read

facilishz

Oct 25

Seventy-One Percent in Three Days: What a Fast Exposure Drop Actually Costs

#security #zoomeye #incidentresponse #ot

4 min read

facilishz

Oct 25

Hanging up is a control instruction: the queuing flaw behind CVE-2026-113380 in Signal RingRTC

#signal #ringrtc #cve2026113380 #mobilesecurity

1

3 min read

facilishz

Oct 25

Detecting abuse of CVE-2026-74041 in Wazuh Manager with the logs you already keep

#vulnerability #wazuh #cve202674041 #securitymonitoring

3 min read

facilishz

Oct 24

The Router That Was Not Supposed to Reach a Shell: Ivanti Connect Secure CVE-2026-104935

#ivanti #authenticationbypass #edgeappliance #kev

3 min read

facilishz

Oct 24

5,623,921 MQTT Services: The Message Bus That Ships With the Building

#zoomeye #mqtt #ics #iot

3 min read

facilishz

Oct 24

ZooKeeper's ACL checks were bypassed twice, in code paths that rarely get reviewed

#security #vulnerabilitymanagement

4 min read

facilishz

Oct 24

ZooKeeper's client port is not a metric for exposed quorums

#security #attacksurfacemanagement

4 min read

facilishz

Oct 24

Kuboard: 5,289 Fingerprinted Consoles, 1,107 Title Matches, and the Cluster Behind Both

#zoomeye #kuboard #kubernetes #exposuremeasurement

3 min read

facilishz

Oct 24

Docassemble: 584 Fingerprints Against 2,899 Titles, and a Guided Interview That Collects What Courts Ask For

#zoomeye #docassemble #documentassembly #legaltech

3 min read

facilishz

Oct 24

A Windows service that grants privilege without asking who is calling

#windows #privilegeescalation #service

4 min read

facilishz

Oct 24

Lemmy: 513 title matches, 94 certificate hits and 207 on 443

#zoomeye #federated #selfhosted

3 min read

facilishz

Oct 23

Docker and NAS deployments: the CVE-2026-96655 upgrade gap

#vulnerability #cve202696655 #plex #ssrf

3 min read

facilishz

Oct 23

A path traversal on a mail gateway is a write primitive, not a file-read bug

#security

4 min read

facilishz

Oct 23

Apache Guacamole: 63 application fingerprints, 4,192 page titles, and a gateway that brokers every session

#security

4 min read

facilishz

Oct 23

CVE-2026-109619: the PHP flaw that outlives its own request

#php #remotecodeexecution #cve2026109618 #vulnerability

3 min read

facilishz

Oct 23

Mapping the fix: which Arista VeloCloud Orchestrator builds close CVE-2026-114625

#vulnerability #sdwan #arista #velocloud

3 min read

facilishz

Oct 23

When the Logs Are Gone: Detecting a Remote-Support Intrusion From Outside

#zoomeye #detection #beyondtrust #telemetry

4 min read

facilishz

Oct 23

PocketBase: 66 fingerprints and 17 hosts on its default port describe a young product, not a small risk

#security

3 min read

facilishz

Oct 23

VeloCloud Orchestrator Patch Triage: Three Release Trains, One Critical SQL Injection

#patchmanagement #vulnerabilitymanagement #sdwan #arista

2 min read

facilishz

Oct 22

Remote support appliances: the exposure you can see is the login page, not the patch level

#security #zoomeyearticle

3 min read

facilishz

Oct 22

The query returned zero, and that is the finding

#security #attacksurfacemanagement

4 min read

facilishz

Oct 22

33,183 or 145: two ZoomEye queries for the same WordPress plugin, and only one of them is an install count

#zoomeye #duplicator #wordpress #cve202682814

4 min read

facilishz

Oct 22

Six MariaDB Branches, Five CVEs: Building a Patch Plan That Actually Closes Them

3 min read

facilishz

Oct 22

CVE-2026-0313 Through a Governance Lens: Content Packs as Unmanaged Code

#vulnerability #cortexxsoar #cve20260313

3 min read

facilishz

Oct 22

Risk Register Decisions for CVE-2026-0315: Scoring a Local macOS Bug Without Inflating It

#riskmanagement #macos #globalprotect #cve20260315

4 min read

facilishz

Oct 22

CVE-2026-102764: A Remote Support Appliance, a Web Shell, and a SUID Backdoor

#vulnerability #remoteaccess #incidentresponse

3 min read

facilishz

Oct 22

Config review for OpenVPN users: the PUSH_UPDATE path behind CVE-2026-88964

#openvpn #vpn #cve #vulnerabilitymanagement

2 min read

facilishz

Oct 21

The UTM Data Chain Behind CVE-2026-102037

#security #juniper #junos #srx

2 min read

facilishz

Oct 21

What to Fix Beyond the Patch: CVE-2026-33792 as a Register Problem

#assetinventory #process #juniper #cve202633792

2 min read

facilishz

Oct 21

Designing a Cold-Chain Exposure Metric That Survives Budget Review

#ics #exposuremanagement

2 min read

facilishz

Oct 21

1,089,053 LDAP Services: Directory Exposure as a Reconnaissance Surface

#zoomeye #identity #exposure

3 min read

facilishz

Oct 20

The Patch Cadence of Document Collaboration Stacks

#patchcadence #nextcloud #operations #cve2026110447

2 min read

facilishz

Oct 20

CVE-2026-70024 and the Supply Chain Behind Unpatched Web Servers

#cybersecurity #infosec #microsoft #security

3 min read

facilishz

Oct 20

The Endpoint Half: What the Advisory Says About mshta and PowerShell

#security #wordpress #clickfix #zoomeye

3 min read

facilishz

Oct 20

Counting BeyondTrust Remote Support appliances before patching CVE-2026-102764

#vulnerability #beyondtrust #cve2026102764 #remotesupport

3 min read

facilishz

Oct 19

Spoofing is not stealing: the CVE-2026-104935 authentication problem

#vulnerability #authentication #cwe290 #ivanti

2 min read

facilishz

Oct 19

Mapping the CVE-2026-75937 version matrix across DAL OS

#security #vulnerability #cve202675937 #digi

2 min read

facilishz

Oct 19

Writing Intelligence Requirements Before Buying Feeds

#threatintelligence #cti #requirements

2 min read

facilishz

Oct 19

CVE-2026-65956: KubePi mounted its SSO management routes on a public path

#kubepi #kubernetes #routeauthorization

2 min read

facilishz

Oct 18

Session Auditing on a Remote-Support Appliance: What Survives a Rebuild

#beyondtrust #cve2026102764 #remotesupport #edgedevices

3 min read

Writing Debut