Ascendant Bot
- Amazon Security Lake , fuzzing , GitHub , GitHub Security Lab , Open Source , Vulnerability research
- December 17, 2024
Uncovering GStreamer secrets
In this post, I’ll walk you through the vulnerabilities I uncovered in the GStreamer library and how I built a custom fuzzing generator to target MP4 files.
The post Uncovering GStreamer secrets appeared first on The GitHub Blog.
- Amazon Security Lake , code scanning , CodeQL , GitHub , GitHub Security Lab , Vulnerability research
- December 11, 2024
CodeQL zero to hero part 4: Gradio framework case study
Learn how I discovered 11 new vulnerabilities by writing CodeQL models for Gradio framework and how you can do it, too.
The post CodeQL zero to hero part 4: Gradio framework case study appeared first on The GitHub Blog.
- Cybersecurity , GitHub , GitHub Security Lab , open source security , Vulnerability research
- October 24, 2024
Attacking browser extensions
Learn about browser extension security and secure your extensions with the help of CodeQL.
The post Attacking browser extensions appeared first on The GitHub Blog.
- CVE , Cybersecurity , GitHub , GitHub Security Lab , Supply chain security , Vulnerability research
- October 21, 2024
Securing the open source supply chain: The essential role of CVEs
Vulnerability data has grown in volume and complexity over the past decade, but open source and programs like the Github Security Lab have helped supply chain security keep pace.
The post Securing the open source supply chain: The essential role of CVEs appeared first on The GitHub Blog.
- Chromecast , exploit development , GitHub , GitHub Security Lab , Vulnerability research
- August 13, 2024
From object transition to RCE in the Chrome renderer
In this post, I’ll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
The post From object transition to RCE in the Chrome renderer appeared first on The GitHub Blog.
- cloud-native , GitHub , GitHub Artifact Attestations , GitHub Security Lab , Supply chain security
- July 30, 2024
Configure GitHub Artifact Attestations for secure cloud-native delivery
Introducing the generally available capability of GitHub Artifact Attestations to secure your cloud-native supply chain packages and images.
The post Configure GitHub Artifact Attestations for secure cloud-native delivery appeared first on The GitHub Blog.
- GitHub , GitHub Security Lab , Vulnerability research
- July 30, 2024
3 ways to get Remote Code Execution in Kafka UI
In this blog post, we’ll explain how we discovered three critical vulnerabilities in Kafka UI and how they can be exploited.
The post 3 ways to get Remote Code Execution in Kafka UI appeared first on The GitHub Blog.
