Security Research

Security Blog

Page 55

critical6 min

Critical Use-After-Free in ESP32 Display Buffer: A Memory Safety Deep Dive

A critical use-after-free vulnerability was discovered in ESP32 firmware's display buffer allocation error handling. When memory allocation fails, freed pointers aren't nullified, creating dangling references that attackers can exploit through controlled heap manipulation. This vulnerability demonstrates why proper pointer hygiene is essential in embedded systems security.

#use-after-free#memory-safety#esp32+4 more
O
orbisai0security
Apr 3, 2026
critical6 min

Critical Command Injection Flaw Fixed in Python CLI Script

A critical command injection vulnerability in a Python script that wraps a C/C++ binary has been patched. The flaw allowed attackers to execute arbitrary commands by injecting shell metacharacters into unsanitized input, potentially compromising entire systems. This fix demonstrates why proper subprocess handling is essential for secure Python development.

#security#command-injection#python+4 more
O
orbisai0security
Apr 3, 2026
high5 min

Subprocess Security: Fixing Command Injection Risks in Python Scripts

A medium-severity vulnerability was discovered in GitLab's export script where the subprocess module was used without proper security considerations, potentially enabling command injection attacks. This fix demonstrates why choosing the right process execution method is critical for application security, and how a simple module selection can make the difference between secure and vulnerable code.

#python-security#command-injection#subprocess+4 more
O
orbisai0security
Mar 28, 2026
high6 min

Command Injection in OSSFS: How Unsafe subprocess.run() Calls Threaten Your File System

A medium-severity command injection vulnerability was discovered in the OSSFS service's file system operations, where subprocess.run() calls with shell=True or unsanitized user-controlled paths could allow attackers to execute arbitrary commands. This vulnerability highlights the critical importance of input validation and secure subprocess handling when dealing with user-provided file paths and mount points.

#security#command-injection#python+4 more
O
orbisai0security
Mar 28, 2026
high7 min

Path Traversal Meets Dependency Vulnerabilities: A Two-Front Security Fix

A critical security update addresses both path traversal vulnerabilities in file system endpoints and a dependency issue with aiohttp's cookie handling. This fix demonstrates how modern applications face security threats on multiple fronts—from custom code vulnerabilities to third-party library weaknesses—and why comprehensive security auditing is essential.

#security#path-traversal#aiohttp+4 more
O
orbisai0security
Mar 28, 2026
medium6 min

Infinite Loop Vulnerability in file-type ASF Parser: CVE-2026-31808 Explained

A medium-severity vulnerability (CVE-2026-31808) was discovered in the file-type library's ASF parser that could cause infinite loops when processing malformed media files with zero-size sub-headers. This denial-of-service vulnerability could crash applications that rely on file-type for media file validation, affecting availability and user experience.

#security#denial-of-service#file-type+4 more
O
orbisai0security
Mar 28, 2026
medium6 min

JWT Authentication Vulnerability: How Weak Token Validation Exposed Dashboard APIs

A critical authentication bypass vulnerability was discovered in a dashboard application where JWT tokens could be forged due to improper validation. The vulnerability affected multiple routes including backup, live chat, and authentication endpoints, potentially allowing attackers to access sensitive operations without proper authorization. This fix demonstrates why robust JWT validation is essential for API security.

#security#jwt#authentication+4 more
O
orbisai0security
Mar 28, 2026
medium7 min

Plaintext OAuth Token Storage: A Medium-Severity Vulnerability Fix

A medium-severity vulnerability was discovered in a Docker CLI authentication plugin where OAuth tokens and API keys were stored in plaintext on the local filesystem without any encryption. Despite having PBKDF2 cryptographic capabilities available in the project dependencies, the authentication store was writing sensitive credentials directly to disk, exposing them to potential theft by malicious actors with filesystem access.

#security#oauth#authentication+4 more
O
orbisai0security
Mar 28, 2026
high6 min

Plaintext OAuth Token Storage: A Silent Security Risk in Your Application

A medium-severity vulnerability was discovered where OAuth tokens and API keys were stored in plaintext on the local filesystem without encryption. Despite having PBKDF2 cryptographic capabilities available in the application's dependencies, these sensitive credentials were written directly to disk, exposing users to potential credential theft and unauthorized account access.

#security#oauth#credential-storage+4 more
O
orbisai0security
Mar 28, 2026
high6 min

OAuth Tokens Exposed: Why Plaintext Credential Storage Is a Critical Mistake

A medium-severity vulnerability was discovered where OAuth tokens and API keys were being stored in plaintext on the local filesystem without any encryption. Despite having PBKDF2 cryptographic capabilities available in the project dependencies, the authentication module was writing sensitive credentials directly to disk, leaving them vulnerable to unauthorized access. This fix addresses a common but dangerous security oversight that could compromise user accounts and API access.

#security#oauth#encryption+4 more
O
orbisai0security
Mar 28, 2026
medium6 min

Plaintext OAuth Tokens: A Critical Security Flaw in Credential Storage

A medium-severity vulnerability was discovered where OAuth tokens and API keys were being stored in plaintext on the local filesystem without any encryption. Despite having PBKDF2 cryptographic capabilities available in the application's dependencies, credentials were written directly to disk, exposing users to potential token theft and unauthorized account access.

#security#oauth#encryption+4 more
O
orbisai0security
Mar 28, 2026
medium7 min

Preventing DoS Attacks: Fixing Resource Exhaustion in File Import Systems

A medium-severity vulnerability in file import functionality left applications vulnerable to Denial of Service (DoS) attacks through maliciously crafted files. By exploiting missing resource limits and validation checks, attackers could exhaust server memory with deeply nested JSON or oversized files, potentially bringing down entire services.

#security#denial-of-service#nodejs+4 more
O
orbisai0security
Mar 19, 2026