Podcasts Technology Day[0] [bounty] GitHub to GitLab RCE and a new PHP Supply Chain Attack

[bounty] GitHub to GitLab RCE and a new PHP Supply Chain Attack

Published: Oct. 18, 2022, 8 p.m.

This week we look at a insecure deserialization (GitLab), argument injection (Packagist), and insecure string interpolation (Apache Commons Text)

\n


\n

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/159.html

\n


\n

[00:00:00] Introduction

\n

[00:01:01] New reward system to accelerate learning and growth on Detectify

\n

[00:04:33] RCE via github import

\n

[00:11:27] Securing Developer Tools: A New Supply Chain Attack on PHP

\n

[00:17:32] FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive [CVE-2022-40684]

\n

[00:23:08] Apache Commons Text Interpolation leading to potential RCE [CVE-2022-42889]

\n