/Hive Five #52 · Jan 10, 2022
Tools & Craft
/The Bee's Knees 🐝
The headline picks from this issue. The full issue has more.
-
Digital Forensics Classroom by 4n6lady
This open and free classroom will be used to share content, and labs that you can do at home and deep dive into Digital Forensics. It is suited for all.Class will begin January 10th, 2021.
Read : Digital Forensics Classroom by 4n6lady -
The Breach They Kept Secret
Andy shares the details of a social media company that experienced a breach and never fully shared the details.
Watch : The Breach They Kept Secret -
Remote Code Execution in Google Cloud Dataflow
After some work, Mike identified an unauthenticated Java JMX service running on Dataflow nodes that, under certain circumstances, would be exposed to the Internet allowing unauthenticated remote code execution as root, in an unprivileged container, on the target Dataflow node.
Read : Remote Code Execution in Google Cloud Dataflow -
Solidity Security - Comprehensive list of known attack vectors and common anti-patterns
This post aims to be a relatively in-depth and up-to-date introductory post detailing the past mistakes that have been made by Solidity developers in an effort to prevent future devs from repeating history.
Read : Solidity Security - Comprehensive list of known attack vectors and common anti-patterns -
The JNDI Strikes Back – Unauthenticated RCE in H2 Database Console
the JFrog security research team has disclosed an issue in the H2 database console which was issued a critical CVE – CVE-2021-42392. This issue has the same root cause as the infamous Log4Shell vulnerability in Apache Log4j (JNDI remote class loading).
Read : The JNDI Strikes Back – Unauthenticated RCE in H2 Database Console