Path Confusion and Mixing Public/Private Keys

Day[0]

Вміст надано dayzerosec. Весь вміст подкастів, включаючи епізоди, графіку та описи подкастів, завантажується та надається безпосередньо компанією dayzerosec або його партнером по платформі подкастів. Якщо ви вважаєте, що хтось використовує ваш захищений авторським правом твір без вашого дозволу, ви можете виконати процедуру, описану тут https://uk.player.fm/legal.

7M ago 59:34

MP3•Головна епізоду

This week's episode features a variety of vulnerabilities, including a warning on mixing up public and private keys in OpenID Connect deployments, as well as path confusion with an nginx+apache setup.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/275.html

[00:00:00] Introduction

[00:19:00] The OOB Read zi Introduced

[00:16:55] Mixing up Public and Private Keys in OpenID Connect deployments

[00:22:51] Nginx/Apache Path Confusion to Auth Bypass in PAN-OS [CVE-2025-0108]

[00:31:50] Hacking High-Profile Bug Bounty Targets: Deep Dive into a Client-Side Chain

[00:44:14] Uncovering Apple Vulnerabilities: diskarbitrationd and storagekitd Audit Part 3

[00:48:48] GigaVulnerability: readout protection bypass on GigaDevice GD32 MCUs

[00:56:57] Attempted Research in PHP Class Pollution

Podcast episodes are available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

282 епізодів

#Tech #dayzerosec