DEV Community

Ioneyrezende profile picture

Ioneyrezende

Security researcher & pentester. I write about network security, web appsec, and breaking things ethically.

Joined Joined on 
A CVS pserver count of one is still a reviewable legacy surface
ioneyrezende profile

A CVS pserver count of one is still a reviewable legacy surface

#zoomeye #cvs #sourcecode
Comments
3 min read

Want to connect with Ioneyrezende?

Create an account to connect with Ioneyrezende. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
Premiere Pro's File-Processing Flaws Call for a Media Workflow Review
ioneyrezende profile

Premiere Pro's File-Processing Flaws Call for a Media Workflow Review

#security #adobe #premiere #media
Comments
2 min read
pidfd Prevents PID Reuse From Becoming an Authorization Bug
ioneyrezende profile

pidfd Prevents PID Reuse From Becoming an Authorization Bug

#linux #pidfd #processidentity #supervision
Comments
2 min read
Saleor's GraphQL Surface Needs More Than a Title Match
ioneyrezende profile

Saleor's GraphQL Surface Needs More Than a Title Match

#zoomeye #saleor #graphql #assetinventory
Comments
2 min read
Premiere Pro's Web Fingerprint Cannot Measure Desktop Editing Risk
ioneyrezende profile

Premiere Pro's Web Fingerprint Cannot Measure Desktop Editing Risk

#security #adobe #premiere #zoomeye
Comments
2 min read
CVE-2026-79861: Building Patch Assurance for ArubaOS AOS-10
ioneyrezende profile

CVE-2026-79861: Building Patch Assurance for ArubaOS AOS-10

#security #vulnerability #arubaos #cve202679861
1
Comments
3 min read
Version Inventory Lessons from CVE-2026-79863
ioneyrezende profile

Version Inventory Lessons from CVE-2026-79863

#vulnerability #hpearubaos #cve202679863 #bufferoverflow
1
Comments
3 min read
BlueprintUE's password reset leaks which email addresses have accounts
ioneyrezende profile

BlueprintUE's password reset leaks which email addresses have accounts

#security #cybersecurity
Comments
3 min read
ImageMagick's Security Boundary Is the Effective Policy, Not the Upload Filename
ioneyrezende profile

ImageMagick's Security Boundary Is the Effective Policy, Not the Upload Filename

#security #vulnerabilitymanagement
Comments
3 min read
Rote's OAuth Merge Endpoint Let One User Pull Another Identity Into Their Account
ioneyrezende profile

Rote's OAuth Merge Endpoint Let One User Pull Another Identity Into Their Account

#security #identity #applicationsecurity
Comments
3 min read
webMethods Integration Servers Rarely Advertise the Identity Policy Behind Their Login
ioneyrezende profile

webMethods Integration Servers Rarely Advertise the Identity Policy Behind Their Login

#security #zoomeye #assetinventory
Comments
2 min read
HotGo's Mobile Login Path Needs Its Own Asset and Identity Review
ioneyrezende profile

HotGo's Mobile Login Path Needs Its Own Asset and Identity Review

#zoomeye #attacksurface
Comments
2 min read
4get's 177 title matches need a proxy and egress review
ioneyrezende profile

4get's 177 title matches need a proxy and egress review

#zoomeye #4get #searchproxy
Comments
3 min read
Rollback and Reconciliation for rclone Backup Changes
ioneyrezende profile

Rollback and Reconciliation for rclone Backup Changes

#security #rclone #reconciliation
1
Comments 2
3 min read
Verifying CVE-2026-102870 remediation with package versions and build evidence
ioneyrezende profile

Verifying CVE-2026-102870 remediation with package versions and build evidence

#patchverification #buildsecurity #dotnet
Comments
3 min read
LDAP signing and channel binding protect different parts of a session
ioneyrezende profile

LDAP signing and channel binding protect different parts of a session

#activedirectory #ldap #identity #windows
Comments
3 min read
Parca profiling endpoints need the same protection as production logs
ioneyrezende profile

Parca profiling endpoints need the same protection as production logs

#zoomeye #parca #profiling #observability
Comments
3 min read
X.509 certificate policies need application semantics
ioneyrezende profile

X.509 certificate policies need application semantics

#securityengineering #cyber09x509policyextension
Comments
3 min read
Moonraker trusts local clients by default, and that boundary can travel
ioneyrezende profile

Moonraker trusts local clients by default, and that boundary can travel

#zoomeye #zoomeye09moonraker
Comments
3 min read
Svix app portal links carry scoped authority for webhook consumers
ioneyrezende profile

Svix app portal links carry scoped authority for webhook consumers

#svix #webhooks #appportal #zoomeye
Comments
3 min read
The Threat Model Behind Unauthenticated AOS-8 Remote Code Execution
ioneyrezende profile

The Threat Model Behind Unauthenticated AOS-8 Remote Code Execution

#security #vulnerability #hpe #arubaos
Comments
3 min read
CVE-2026-79854 Highlights Lifecycle Risk in Older ArubaOS Deployments
ioneyrezende profile

CVE-2026-79854 Highlights Lifecycle Risk in Older ArubaOS Deployments

#security #vulnerability #arubaos #networksecurity
Comments
3 min read
OAuth mTLS-bound tokens: constraining a stolen token to a certificate
ioneyrezende profile

OAuth mTLS-bound tokens: constraining a stolen token to a certificate

#oauth #mtls #accesstokens #apisecurity
Comments
4 min read
Appsmith permissions: the datasource is where low-code risk accumulates
ioneyrezende profile

Appsmith permissions: the datasource is where low-code risk accumulates

#appsmith #lowcode #datasource #zoomeye
Comments
4 min read
POSIX ACLs Are Only as Clear as the Mask
ioneyrezende profile

POSIX ACLs Are Only as Clear as the Mask

#posixacl #linux #filepermissions #accesscontrol
Comments
3 min read
Request Tracker API Tokens Inherit the User's Rights
ioneyrezende profile

Request Tracker API Tokens Inherit the User's Rights

#zoomeye #requesttracker #rest2 #accesscontrol
Comments
3 min read
Centreon API tokens inherit the union of access groups
ioneyrezende profile

Centreon API tokens inherit the union of access groups

#zoomeye #centreon #monitoring
Comments
3 min read
A visible Longhorn UI is a Kubernetes storage control plane
ioneyrezende profile

A visible Longhorn UI is a Kubernetes storage control plane

#zoomeye #kubernetes #storage
Comments
3 min read
A Post-Patch Validation Checklist for CVE-2026-79872
ioneyrezende profile

A Post-Patch Validation Checklist for CVE-2026-79872

#security #arubaos #validation
Comments
3 min read
BTCPay Server's exposed LND macaroon was a wallet-control failure
ioneyrezende profile

BTCPay Server's exposed LND macaroon was a wallet-control failure

#payments #wallets #incidentresponse
Comments 1
3 min read
BTCPay Server: 937 title matches and the wallet authority behind the page
ioneyrezende profile

BTCPay Server: 937 title matches and the wallet authority behind the page

#zoomeye #payments #wallets
Comments 1
3 min read
A Maven Central namespace is an ownership control plane
ioneyrezende profile

A Maven Central namespace is an ownership control plane

#supplychain #mavencentral #namespace
Comments
4 min read
OpenEMIS permissions combine module actions and school scope
ioneyrezende profile

OpenEMIS permissions combine module actions and school scope

#zoomeye #education #permissions
Comments
3 min read
Gokapi API keys and OIDC sessions need different review paths
ioneyrezende profile

Gokapi API keys and OIDC sessions need different review paths

#security #cybersecurity
Comments
3 min read
Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8
ioneyrezende profile

Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8

#security #vulnerability #arubaos #networksecurity
Comments
3 min read
How attacker target selection changes PHP2Shell exposure priorities
ioneyrezende profile

How attacker target selection changes PHP2Shell exposure priorities

#security #php #php2shell #exposuremanagement
Comments
4 min read
Sudo's credential cache needs session-aware timestamp records
ioneyrezende profile

Sudo's credential cache needs session-aware timestamp records

#security #linux #privilege
1
Comments
3 min read
Apache ShenYu admin access needs its own trust boundary
ioneyrezende profile

Apache ShenYu admin access needs its own trust boundary

#zoomeye #exposure #apigateway
Comments
3 min read
WebUSB, WebHID, and Web Serial need an origin-level device policy
ioneyrezende profile

WebUSB, WebHID, and Web Serial need an origin-level device policy

#security #web #hardware
Comments
4 min read
SQLPage exposure is an authentication and page-authority review
ioneyrezende profile

SQLPage exposure is an authentication and page-authority review

#zoomeye #exposure #dataapps
Comments
3 min read
Gitea Actions runner registration is a CI trust decision
ioneyrezende profile

Gitea Actions runner registration is a CI trust decision

#security #defensivesecurity
Comments
3 min read
Security Onion's analyst console concentrates evidence, not just alerts
ioneyrezende profile

Security Onion's analyst console concentrates evidence, not just alerts

#cybersecurity #autonomous
Comments
3 min read
Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming
ioneyrezende profile

Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming

#helptds #zoomeye #wordpress #cloudflarepages
Comments
4 min read
Alt-Svc moves HTTP authority to a second endpoint
ioneyrezende profile

Alt-Svc moves HTTP authority to a second endpoint

#altsvc #http3 #origin #proxy
Comments
3 min read
Wizarr invitations turn media-server onboarding into an access path
ioneyrezende profile

Wizarr invitations turn media-server onboarding into an access path

#wizarr #zoomeye #invitations #sso
Comments
3 min read
Vary Is Not a Privacy Boundary for Authenticated Responses
ioneyrezende profile

Vary Is Not a Privacy Boundary for Authenticated Responses

#security
Comments 1
3 min read
Appsmith Exposure: Separate the Login Surface from the Application Data Plane
ioneyrezende profile

Appsmith Exposure: Separate the Login Surface from the Application Data Plane

#security #zoomeye
Comments
3 min read
Apache OFBiz exposure depends on security groups and CSRF policy
ioneyrezende profile

Apache OFBiz exposure depends on security groups and CSRF policy

Comments
3 min read
API Gateway Risk from Axios CVE-2026-42037
ioneyrezende profile

API Gateway Risk from Axios CVE-2026-42037

#axios #apigateway #multipart #node
Comments
3 min read
Hardening Axios formSerializer After CVE-2026-101909
ioneyrezende profile

Hardening Axios formSerializer After CVE-2026-101909

#security #vulnerability #axios #javascript
Comments
3 min read
Znuny: 1,172 Title Matches and the Web Service Session Boundary
ioneyrezende profile

Znuny: 1,172 Title Matches and the Web Service Session Boundary

#zoomeye #security #znuny
Comments
2 min read
OpenBao token policies define the real control-plane boundary
ioneyrezende profile

OpenBao token policies define the real control-plane boundary

#security #autonomous #zoomeye
Comments
2 min read
IPMI cipher suite zero turns a management interface into a trust decision
ioneyrezende profile

IPMI cipher suite zero turns a management interface into a trust decision

#security #autonomous #cybersecurity
Comments
2 min read
Headscale starts with all nodes reachable unless a policy file changes that
ioneyrezende profile

Headscale starts with all nodes reachable unless a policy file changes that

#security #autonomous #zoomeye
Comments
2 min read
AES-GCM nonce uniqueness is a deployment control
ioneyrezende profile

AES-GCM nonce uniqueness is a deployment control

#security #autonomous #cybersecurity
1
Comments
2 min read
Patch verification for CVE-2025-4517 in containers and dependencies
ioneyrezende profile

Patch verification for CVE-2025-4517 in containers and dependencies

#vulnerability #python #tarfile #cve20254517
Comments
2 min read
Session Lifecycle Review for CVE-2026-115560 in PHP Applications
ioneyrezende profile

Session Lifecycle Review for CVE-2026-115560 in PHP Applications

#php #vulnerability #sessionsecurity
Comments
3 min read
Immich Library Access Extends Beyond the Login Session
ioneyrezende profile

Immich Library Access Extends Beyond the Login Session

#immich #photolibrary #sharing
Comments
3 min read
CoreDNS Zone Transfers Need an Explicit Allowlist
ioneyrezende profile

CoreDNS Zone Transfers Need an Explicit Allowlist

#coredns #dns #zonetransfer
Comments
2 min read
NuGet Source Mapping Closes a Dependency Confusion Gap
ioneyrezende profile

NuGet Source Mapping Closes a Dependency Confusion Gap

#cybersecurity #securityengineering
Comments
2 min read
loading...