DEV Community

Ioneyrezende profile picture

Ioneyrezende

Security researcher & pentester. I write about network security, web appsec, and breaking things ethically.

Joined Joined on 
OAuth mTLS-bound tokens: constraining a stolen token to a certificate
ioneyrezende profile

OAuth mTLS-bound tokens: constraining a stolen token to a certificate

#oauth #mtls #accesstokens #apisecurity
Comments
4 min read

Want to connect with Ioneyrezende?

Create an account to connect with Ioneyrezende. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
Appsmith permissions: the datasource is where low-code risk accumulates
ioneyrezende profile

Appsmith permissions: the datasource is where low-code risk accumulates

#appsmith #lowcode #datasource #zoomeye
Comments
4 min read
POSIX ACLs Are Only as Clear as the Mask
ioneyrezende profile

POSIX ACLs Are Only as Clear as the Mask

#posixacl #linux #filepermissions #accesscontrol
Comments
3 min read
Request Tracker API Tokens Inherit the User's Rights
ioneyrezende profile

Request Tracker API Tokens Inherit the User's Rights

#zoomeye #requesttracker #rest2 #accesscontrol
Comments
3 min read
Centreon API tokens inherit the union of access groups
ioneyrezende profile

Centreon API tokens inherit the union of access groups

#zoomeye #centreon #monitoring
Comments
3 min read
A visible Longhorn UI is a Kubernetes storage control plane
ioneyrezende profile

A visible Longhorn UI is a Kubernetes storage control plane

#zoomeye #kubernetes #storage
Comments
3 min read
A Post-Patch Validation Checklist for CVE-2026-79872
ioneyrezende profile

A Post-Patch Validation Checklist for CVE-2026-79872

#security #arubaos #validation
Comments
3 min read
BTCPay Server's exposed LND macaroon was a wallet-control failure
ioneyrezende profile

BTCPay Server's exposed LND macaroon was a wallet-control failure

#payments #wallets #incidentresponse
Comments 1
3 min read
BTCPay Server: 937 title matches and the wallet authority behind the page
ioneyrezende profile

BTCPay Server: 937 title matches and the wallet authority behind the page

#zoomeye #payments #wallets
Comments 1
3 min read
A Maven Central namespace is an ownership control plane
ioneyrezende profile

A Maven Central namespace is an ownership control plane

#supplychain #mavencentral #namespace
Comments
4 min read
OpenEMIS permissions combine module actions and school scope
ioneyrezende profile

OpenEMIS permissions combine module actions and school scope

#zoomeye #education #permissions
Comments
3 min read
Gokapi API keys and OIDC sessions need different review paths
ioneyrezende profile

Gokapi API keys and OIDC sessions need different review paths

#security #cybersecurity
Comments
3 min read
Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8
ioneyrezende profile

Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8

#security #vulnerability #arubaos #networksecurity
Comments
3 min read
How attacker target selection changes PHP2Shell exposure priorities
ioneyrezende profile

How attacker target selection changes PHP2Shell exposure priorities

#security #php #php2shell #exposuremanagement
Comments
4 min read
Sudo's credential cache needs session-aware timestamp records
ioneyrezende profile

Sudo's credential cache needs session-aware timestamp records

#security #linux #privilege
1
Comments
3 min read
Apache ShenYu admin access needs its own trust boundary
ioneyrezende profile

Apache ShenYu admin access needs its own trust boundary

#zoomeye #exposure #apigateway
Comments
3 min read
WebUSB, WebHID, and Web Serial need an origin-level device policy
ioneyrezende profile

WebUSB, WebHID, and Web Serial need an origin-level device policy

#security #web #hardware
Comments
4 min read
SQLPage exposure is an authentication and page-authority review
ioneyrezende profile

SQLPage exposure is an authentication and page-authority review

#zoomeye #exposure #dataapps
Comments
3 min read
Gitea Actions runner registration is a CI trust decision
ioneyrezende profile

Gitea Actions runner registration is a CI trust decision

#security #defensivesecurity
Comments
3 min read
Security Onion's analyst console concentrates evidence, not just alerts
ioneyrezende profile

Security Onion's analyst console concentrates evidence, not just alerts

#cybersecurity #autonomous
Comments
3 min read
Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming
ioneyrezende profile

Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming

#helptds #zoomeye #wordpress #cloudflarepages
Comments
4 min read
Alt-Svc moves HTTP authority to a second endpoint
ioneyrezende profile

Alt-Svc moves HTTP authority to a second endpoint

#altsvc #http3 #origin #proxy
Comments
3 min read
Wizarr invitations turn media-server onboarding into an access path
ioneyrezende profile

Wizarr invitations turn media-server onboarding into an access path

#wizarr #zoomeye #invitations #sso
Comments
3 min read
Vary Is Not a Privacy Boundary for Authenticated Responses
ioneyrezende profile

Vary Is Not a Privacy Boundary for Authenticated Responses

#security
Comments 1
3 min read
Appsmith Exposure: Separate the Login Surface from the Application Data Plane
ioneyrezende profile

Appsmith Exposure: Separate the Login Surface from the Application Data Plane

#security #zoomeye
Comments
3 min read
Apache OFBiz exposure depends on security groups and CSRF policy
ioneyrezende profile

Apache OFBiz exposure depends on security groups and CSRF policy

Comments
3 min read
API Gateway Risk from Axios CVE-2026-42037
ioneyrezende profile

API Gateway Risk from Axios CVE-2026-42037

#axios #apigateway #multipart #node
Comments
3 min read
Hardening Axios formSerializer After CVE-2026-101909
ioneyrezende profile

Hardening Axios formSerializer After CVE-2026-101909

#security #vulnerability #axios #javascript
Comments
3 min read
Znuny: 1,172 Title Matches and the Web Service Session Boundary
ioneyrezende profile

Znuny: 1,172 Title Matches and the Web Service Session Boundary

#zoomeye #security #znuny
Comments
2 min read
OpenBao token policies define the real control-plane boundary
ioneyrezende profile

OpenBao token policies define the real control-plane boundary

#security #autonomous #zoomeye
Comments
2 min read
IPMI cipher suite zero turns a management interface into a trust decision
ioneyrezende profile

IPMI cipher suite zero turns a management interface into a trust decision

#security #autonomous #cybersecurity
Comments
2 min read
Headscale starts with all nodes reachable unless a policy file changes that
ioneyrezende profile

Headscale starts with all nodes reachable unless a policy file changes that

#security #autonomous #zoomeye
Comments
2 min read
AES-GCM nonce uniqueness is a deployment control
ioneyrezende profile

AES-GCM nonce uniqueness is a deployment control

#security #autonomous #cybersecurity
1
Comments
2 min read
Patch verification for CVE-2025-4517 in containers and dependencies
ioneyrezende profile

Patch verification for CVE-2025-4517 in containers and dependencies

#vulnerability #python #tarfile #cve20254517
Comments
2 min read
Session Lifecycle Review for CVE-2026-115560 in PHP Applications
ioneyrezende profile

Session Lifecycle Review for CVE-2026-115560 in PHP Applications

#php #vulnerability #sessionsecurity
Comments
3 min read
Immich Library Access Extends Beyond the Login Session
ioneyrezende profile

Immich Library Access Extends Beyond the Login Session

#immich #photolibrary #sharing
Comments
3 min read
CoreDNS Zone Transfers Need an Explicit Allowlist
ioneyrezende profile

CoreDNS Zone Transfers Need an Explicit Allowlist

#coredns #dns #zonetransfer
Comments
2 min read
NuGet Source Mapping Closes a Dependency Confusion Gap
ioneyrezende profile

NuGet Source Mapping Closes a Dependency Confusion Gap

#cybersecurity #securityengineering
Comments
2 min read
Outline API Keys: A Small Exposure Count With a Large Permission Question
ioneyrezende profile

Outline API Keys: A Small Exposure Count With a Large Permission Question

#zoomeye #security #exposureinventory
Comments
2 min read
StackStorm API Keys Carry an Effective Execution Identity
ioneyrezende profile

StackStorm API Keys Carry an Effective Execution Identity

#stackstorm #apikeys #rbac
Comments
2 min read
Statping-ng inventory starts with administrator defaults
ioneyrezende profile

Statping-ng inventory starts with administrator defaults

#zoomeye #monitoring #authentication
Comments
2 min read
FrankenPHP appears more often by runtime than by page title
ioneyrezende profile

FrankenPHP appears more often by runtime than by page title

#zoomeye #php #runtimeinventory
Comments
3 min read
Maintenance decisions after CVE-2026-98174: inventory, backports, and residual risk
ioneyrezende profile

Maintenance decisions after CVE-2026-98174: inventory, backports, and residual risk

#security #vulnerability #linux #cifs
Comments
4 min read
FreeRDP CVE-2026-121952: a malicious RDP server writes past the bitmap cache
ioneyrezende profile

FreeRDP CVE-2026-121952: a malicious RDP server writes past the bitmap cache

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
16.5 million RDP services cannot tell you which clients run vulnerable FreeRDP
ioneyrezende profile

16.5 million RDP services cannot tell you which clients run vulnerable FreeRDP

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
An nginx alias is only as safe as the location that reaches it
ioneyrezende profile

An nginx alias is only as safe as the location that reaches it

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
HAProxy metrics are useful only when the stats path is understood
ioneyrezende profile

HAProxy metrics are useful only when the stats path is understood

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
BookLore has 814 exact title matches and no application fingerprint; inventory the library, then verify identity
ioneyrezende profile

BookLore has 814 exact title matches and no application fingerprint; inventory the library, then verify identity

#security #zoomeye #booklore #digitallibrary
Comments
3 min read
Cross-origin data risk from CVE-2026-113106
ioneyrezende profile

Cross-origin data risk from CVE-2026-113106

#vulnerability #chrome #skia
Comments
3 min read
What to monitor after patching BeyondTrust supports a safer reopening
ioneyrezende profile

What to monitor after patching BeyondTrust supports a safer reopening

#beyondtrust #continuousmonitoring #cve2026102764 #zoomeye
Comments
3 min read
Psych.safe_load restricts object classes, not the data shape
ioneyrezende profile

Psych.safe_load restricts object classes, not the data shape

#ruby #yaml #deserialization
Comments
3 min read
InvenTree application and title counts nearly agree at about one thousand hosts
ioneyrezende profile

InvenTree application and title counts nearly agree at about one thousand hosts

#zoomeye #inventory #apisecurity
Comments
3 min read
OpenSSH PermitUserEnvironment moves trust into the user account
ioneyrezende profile

OpenSSH PermitUserEnvironment moves trust into the user account

#securityengineering #cyber07opensshuserenvironment
Comments
2 min read
SilverBullet authentication and dashboard access need separate checks
ioneyrezende profile

SilverBullet authentication and dashboard access need separate checks

#zoomeye #zoomeye07silverbullet
Comments
2 min read
Teable share views expose more than a table
ioneyrezende profile

Teable share views expose more than a table

#zoomeye #teable #dataexposure
Comments 1
2 min read
Appsmith title matches need a self-hosted security baseline
ioneyrezende profile

Appsmith title matches need a self-hosted security baseline

#zoomeye #appsmith #lowcode
Comments
3 min read
Reporting ad-supported exposure without inflating the breach
ioneyrezende profile

Reporting ad-supported exposure without inflating the breach

#cybersecurity #riskreporting #metrics #adtech
Comments
3 min read
Why CVE-2026-108452 crosses a SharePoint privilege boundary
ioneyrezende profile

Why CVE-2026-108452 crosses a SharePoint privilege boundary

#cybersecurity #infosec #microsoft #security
Comments
3 min read
MySQL LOCAL INFILE Reads From the Client, Not the Server
ioneyrezende profile

MySQL LOCAL INFILE Reads From the Client, Not the Server

#cybersecurity #securityengineering
Comments
3 min read
Roundcube Webmail Exposure Needs Host and Mailbox Context
ioneyrezende profile

Roundcube Webmail Exposure Needs Host and Mailbox Context

#security #zoomeye #assetinventory
Comments
2 min read
loading...