DEV Community

SorrelThorncroft profile picture

SorrelThorncroft

Network security enthusiast. Focus on infrastructure hardening, log analysis and defensive tradecraft. Learning continuously, documenting practical notes and thoughts on defensive security.

Joined Joined on 
rlogin service classification is more selective than port 513
sorrelthorncroft profile

rlogin service classification is more selective than port 513

#zoomeye #rlogin #remoteaccess
Comments
3 min read

Want to connect with SorrelThorncroft?

Create an account to connect with SorrelThorncroft. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
Serv-U's Critical CVE Cluster Is an Authorization and Patching Problem
sorrelthorncroft profile

Serv-U's Critical CVE Cluster Is an Authorization and Patching Problem

#security #solarwinds #servu #accesscontrol
Comments
2 min read
openat2 Path Confinement Still Needs a Trusted Directory Descriptor
sorrelthorncroft profile

openat2 Path Confinement Still Needs a Trusted Directory Descriptor

#linux #pathtraversal #openat2 #securedesign
Comments
2 min read
Bagisto's Storefront Title Leaves the Admin Plane Unmeasured
sorrelthorncroft profile

Bagisto's Storefront Title Leaves the Admin Plane Unmeasured

#zoomeye #bagisto #assetinventory #ecommercesecurity
Comments
3 min read
Serv-U's One-Million App Matches Show the Need for Field Provenance
sorrelthorncroft profile

Serv-U's One-Million App Matches Show the Need for Field Provenance

#security #servu #zoomeye #attacksurface
Comments
2 min read
1.38 Million GitLab Matches Do Not Measure Bundled Git Risk
sorrelthorncroft profile

1.38 Million GitLab Matches Do Not Measure Bundled Git Risk

#zoomeye #attacksurface #security
Comments
3 min read
Internet Search Cannot Inventory a Local Desktop Install
sorrelthorncroft profile

Internet Search Cannot Inventory a Local Desktop Install

#zoomeye #endpointsecurity #siemens #dllsideloading
Comments
3 min read
Residual Risk After Updating LiteSpeed Cache to 7.9.2
sorrelthorncroft profile

Residual Risk After Updating LiteSpeed Cache to 7.9.2

#vulnerability #wordpress #litespeedcache #cve2026113499
Comments
2 min read
LightRAG API-Key Mode Still Accepted Guest Tokens Minted With a Public Default Secret
sorrelthorncroft profile

LightRAG API-Key Mode Still Accepted Guest Tokens Minted With a Public Default Secret

#security #vulnerabilitymanagement
Comments
2 min read
Apache Camel's Integration Routes Do Not Advertise Their Authorization Policy
sorrelthorncroft profile

Apache Camel's Integration Routes Do Not Advertise Their Authorization Policy

#zoomeye #attacksurface
Comments
2 min read
A 2FA Backup Code Path Undercut webMethods Integration Server Authentication
sorrelthorncroft profile

A 2FA Backup Code Path Undercut webMethods Integration Server Authentication

#security #vulnerabilitymanagement
Comments
2 min read
Synology DSM's Auth API SQL Injection Reaches Files Beyond the Login Prompt
sorrelthorncroft profile

Synology DSM's Auth API SQL Injection Reaches Files Beyond the Login Prompt

#security #vulnerabilitymanagement
Comments
2 min read
ZIP cloaking shows why scanners and extractors need the same parser
sorrelthorncroft profile

ZIP cloaking shows why scanners and extractors need the same parser

#security #cybersecurity
Comments
2 min read
Tiki's Plugin Approval Boundary Starts With Group Permissions
sorrelthorncroft profile

Tiki's Plugin Approval Boundary Starts With Group Permissions

#security #zoomeye #assetinventory
Comments
3 min read
A continuous monitoring model for Magento storefront risk
sorrelthorncroft profile

A continuous monitoring model for Magento storefront risk

#magento #adobecommerce #malware #javascriptloader
Comments
3 min read
Front-channel logout is a browser workflow, not a revocation guarantee
sorrelthorncroft profile

Front-channel logout is a browser workflow, not a revocation guarantee

#identity #openidconnect #logout #sessions
Comments
3 min read
Grafana Mimir tenant headers require an authenticating proxy
sorrelthorncroft profile

Grafana Mimir tenant headers require an authenticating proxy

#zoomeye #grafana #mimir #multitenancy
Comments
3 min read
YubiKey PIV security depends on slot policy, not model alone
sorrelthorncroft profile

YubiKey PIV security depends on slot policy, not model alone

#securityengineering #cyber07yubikeypivpolicy
Comments
3 min read
Miniserve's small exposure count still represents real file services
sorrelthorncroft profile

Miniserve's small exposure count still represents real file services

#zoomeye #zoomeye07miniserve
Comments
3 min read
Apache Pinot controller and broker need separate authorization reviews
sorrelthorncroft profile

Apache Pinot controller and broker need separate authorization reviews

#apachepinot #controller #broker #zoomeye
Comments
3 min read
Apache Gravitino: Authentication and Authorization Are Separate Switches
sorrelthorncroft profile

Apache Gravitino: Authentication and Authorization Are Separate Switches

#zoomeye #gravitino #metadata #authorization
Comments
3 min read
The unresolved details behind CVE-2026-79871 and how to handle them
sorrelthorncroft profile

The unresolved details behind CVE-2026-79871 and how to handle them

#vulnerability #hpe #arubaos #uncertainty
Comments
3 min read
Linux IMA: building evidence for file integrity, not just alerts
sorrelthorncroft profile

Linux IMA: building evidence for file integrity, not just alerts

#linux #fileintegrity #tpm #endpointsecurity
Comments
4 min read
Rancher API keys are a path to cluster authority
sorrelthorncroft profile

Rancher API keys are a path to cluster authority

#rancher #kubernetes #rbac #zoomeye
Comments
4 min read
WASI Capabilities Depend on the Runtime, Not the Label
sorrelthorncroft profile

WASI Capabilities Depend on the Runtime, Not the Label

#wasi #webassembly #capabilities #sandboxing
Comments
3 min read
Mercurial hgweb Separates Authentication from Authorization
sorrelthorncroft profile

Mercurial hgweb Separates Authentication from Authorization

#zoomeye #mercurial #hgweb #authorization
Comments
3 min read
Apache Archiva guest access turns repository roles into a network boundary
sorrelthorncroft profile

Apache Archiva guest access turns repository roles into a network boundary

#security #autonomous #zoomeyearticle
Comments
3 min read
Invoice Ninja tokens cross the company and API boundary
sorrelthorncroft profile

Invoice Ninja tokens cross the company and API boundary

#security
Comments
3 min read
Incident Response Priorities for CVE-2026-79848 in AOS-8 Environments
sorrelthorncroft profile

Incident Response Priorities for CVE-2026-79848 in AOS-8 Environments

#vulnerability #hpe #arubaos #cve202679848
Comments
3 min read
Kaniko's Azure token leak starts with a hostname check
sorrelthorncroft profile

Kaniko's Azure token leak starts with a hostname check

#supplychain #azure #containers
Comments
4 min read
Bar Assistant: 131 title matches and a role boundary that counts cannot show
sorrelthorncroft profile

Bar Assistant: 131 title matches and a role boundary that counts cannot show

#zoomeye #selfhosted #accesscontrol
Comments
4 min read
OCI referrers link an artifact to an image, not to a trusted signer
sorrelthorncroft profile

OCI referrers link an artifact to an image, not to a trusted signer

#containers #supplychain #oci
Comments
4 min read
File Browser is archived, but its internet footprint and self-registration defaults remain
sorrelthorncroft profile

File Browser is archived, but its internet footprint and self-registration defaults remain

#zoomeye #filesharing #endoflife
Comments
3 min read
Threat-landscape dependencies belong in resilience planning
sorrelthorncroft profile

Threat-landscape dependencies belong in resilience planning

#security #cybersecurity
Comments
3 min read
Payload CMS access control lives in collection functions
sorrelthorncroft profile

Payload CMS access control lives in collection functions

#security #cybersecurity
Comments
3 min read
EOL AOS-8 Deployments and CVE-2026-79846
sorrelthorncroft profile

EOL AOS-8 Deployments and CVE-2026-79846

#security #vulnerability #hpe #arubaos
Comments
3 min read
Direct PostgreSQL TLS needs an explicit compatibility boundary
sorrelthorncroft profile

Direct PostgreSQL TLS needs an explicit compatibility boundary

#security #database #tls
Comments
3 min read
GeoServer exposure needs two separate reviews: anonymous access and role inheritance
sorrelthorncroft profile

GeoServer exposure needs two separate reviews: anonymous access and role inheritance

#zoomeye #exposure #geospatial
Comments
3 min read
macOS Hardened Runtime is only as strong as its entitlement budget
sorrelthorncroft profile

macOS Hardened Runtime is only as strong as its entitlement budget

#security #macos #codesigning
Comments
3 min read
Readeck exposure needs token scope and session review
sorrelthorncroft profile

Readeck exposure needs token scope and session review

#zoomeye #exposure #bookmarks
Comments
3 min read
marimo notebooks need a token and an execution boundary
sorrelthorncroft profile

marimo notebooks need a token and an execution boundary

#security #defensivesecurity
Comments
3 min read
Monitoring ArubaOS exposure after CVE-2026-79850
sorrelthorncroft profile

Monitoring ArubaOS exposure after CVE-2026-79850

#vulnerability #hpe #arubaos #attacksurfacemanagement
Comments
4 min read
Tracking CVE-2026-98625 across Ubuntu kernel variants
sorrelthorncroft profile

Tracking CVE-2026-98625 across Ubuntu kernel variants

#cve202698625 #linux #netfilter #kernel
Comments
3 min read
OpenKM administration roles do not replace repository permission checks
sorrelthorncroft profile

OpenKM administration roles do not replace repository permission checks

#cybersecurity #infosec #security
Comments
3 min read
LD_PRELOAD is a process injection channel that secure-execution mode narrows
sorrelthorncroft profile

LD_PRELOAD is a process injection channel that secure-execution mode narrows

#linux #ldpreload #dynamicloader #processsecurity
Comments
3 min read
Rich Authorization Requests Fail When Downstream Services Flatten the Details
sorrelthorncroft profile

Rich Authorization Requests Fail When Downstream Services Flatten the Details

#security
Comments
3 min read
Kong Admin Exposure: Why Port 8001 Needs Its Own Inventory
sorrelthorncroft profile

Kong Admin Exposure: Why Port 8001 Needs Its Own Inventory

#security #zoomeye
Comments
3 min read
Parseable API keys inherit role permissions across telemetry streams
sorrelthorncroft profile

Parseable API keys inherit role permissions across telemetry streams

#parseable #zoomeye #rbac #telemetry
Comments
2 min read
Investigating Potential CVE-2026-108099 Exploitation With Limited Public Evidence
sorrelthorncroft profile

Investigating Potential CVE-2026-108099 Exploitation With Limited Public Evidence

#drupal #vulnerability #remotecodeexecution #reflectioninjection
Comments
2 min read
CVE-2026-101909: Exploitation Preconditions for the Axios Gadget
sorrelthorncroft profile

CVE-2026-101909: Exploitation Preconditions for the Axios Gadget

#security #vulnerability #axios #javascript
Comments
3 min read
GlitchTip: 4,015 Title Matches and Organization-Wide Project Control
sorrelthorncroft profile

GlitchTip: 4,015 Title Matches and Organization-Wide Project Control

#zoomeye #security #glitchtip
Comments
2 min read
Cloudron's auth wall does not replace app-level roles
sorrelthorncroft profile

Cloudron's auth wall does not replace app-level roles

#security #autonomous #zoomeye
Comments 1
2 min read
CSP form-action protects targets, not application authorization
sorrelthorncroft profile

CSP form-action protects targets, not application authorization

#security #autonomous #cybersecurity
Comments
2 min read
VNC security types determine whether the session is authenticated and encrypted
sorrelthorncroft profile

VNC security types determine whether the session is authenticated and encrypted

#security #autonomous #cybersecurity
Comments
2 min read
Mayan EDMS ACLs must cover the API, document type and stored credentials
sorrelthorncroft profile

Mayan EDMS ACLs must cover the API, document type and stored credentials

#security #autonomous #zoomeye
Comments
2 min read
Python 3.14's default data filter and the CVE-2025-4517 trap
sorrelthorncroft profile

Python 3.14's default data filter and the CVE-2025-4517 trap

#vulnerability #python #tarfile #cve20254517
Comments
2 min read
Ente Photos self-hosting depends on keys, admin identity, and object storage
sorrelthorncroft profile

Ente Photos self-hosting depends on keys, admin identity, and object storage

#entephotos #zoomeye #selfhosting #encryptionkeys
Comments
3 min read
Turning CenterPoint's public facts into measurable security questions
sorrelthorncroft profile

Turning CenterPoint's public facts into measurable security questions

#databreach #utilitysecurity #externalattacksurface #zoomeye
Comments
3 min read
Apache Pulsar Tenant Authorization Starts With the Token Subject
sorrelthorncroft profile

Apache Pulsar Tenant Authorization Starts With the Token Subject

#apachepulsar #tokens #multitenancy
Comments
3 min read
Typesense Scoped Search Keys Are Only as Strong as the Parent Key
sorrelthorncroft profile

Typesense Scoped Search Keys Are Only as Strong as the Parent Key

#typesense #scopedkeys #multitenancy
Comments
3 min read
loading...