Collaborate Disseminate
Suppose there is an application which contained preview functionality, that means whatever the code (if it is PHP, HTML Python) the user writes, the user can preview the code.
For ex:
<?php echo "hello this is test"?>
When… Continue reading How to secure a code preview function?
I face a CSP header something like this –
default-src https:; font-src https: data:; img-src https: data:; script-src https: ‘unsafe-inline’ ‘unsafe-eval’; style-src https: ‘unsafe-inline’;
So is this is secure implementation?
This include… Continue reading Is this CSP implementation is secure?
I found an information leakage vulnerability on a company website and I found that the information includes all the usernames of the users.
I also observed that the application uses a lockout mechanism that locks out users after 5 attempts… Continue reading Will this Account Lockout mechanism increase the severity of a information leakage vulnerability that leaks usernames?
Suppose
I reported a critical vulnerability at their responsible disclosure email, and I share the impact of the vulnerability but not the actual information in the first email.
They replied back stating, ‘what is the vulnerability informa… Continue reading Security researcher asked for responsible disclosure but not want to disclosure anymore? [closed]
I have an instance running with access scope ‘Set Access for each API’, and explicitly allowing Compute Engine API with Read Write access.
So I logged inside the instance, and I tried to run this command:-
gcloud compute instances list
and… Continue reading I am not able to access compute engine API with gcloud? [closed]