Melliferous

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   Monitor trending CVEs

   Data comes from Twitter + NIST NVD APIs - back-end: Python, Flask, PostgreSQL, and Redis - front-end: React + Bootstrap.

   Read : Monitor trending CVEs
2. /02

   $16k Stealing secrets.yaml from GitLab using stored XSS - Hackerone bug bounty

   This video is an explanation of a bug bounty report submitted to GitLab bug bounty program via Hackerone by William Bowling.

   Watch : $16k Stealing secrets.yaml from GitLab using stored XSS - Hackerone bug bounty
3. /03

   Wordpress Plugin Update Confusion - The full guide how to scan and mitigate the next big Supply Chain Attack

   A couple of month ago while browsing twitter on a weekend Nagli stubmled upon a rather interesting post from @vavkamil.

   Read : Wordpress Plugin Update Confusion - The full guide how to scan and mitigate the next big Supply Chain Attack
4. /04

   Finding XSS on .apple.com and building a proof of concept to leak your PII information

   Back in February of this year zseano hacked with members of BugBountyHunter.com on a public bug bounty program and we chose Apple as our target.

   Read : Finding XSS on .apple.com and building a proof of concept to leak your PII information
5. /05

   Enzyme Finance Price Oracle Manipulation Bug Fix Postmortem

   In 2020 and at the beginning of 2021, one of the worst phrases you could hear either as a DeFi security researcher or developer was, “Project X was hacked due to Price Oracle manipulation using flashloans.

   Read : Enzyme Finance Price Oracle Manipulation Bug Fix Postmortem