Blog
Summary Been a while since my last CVE :) If you are only interested in how to protect yourself against this vulnerability, jump to the Mitigation section. Otherwise, keep on reading. CVSS Score: 8.8 (High) CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected versions: 29.4 and earlier Fixed version: 30.1 Vendor advisory: emacs-devel CVE advisories: NVD , MITRE OS advisories: Red Hat CVE ,…
My relationship with games is complicated. I never had the chance to get good at them and few I’ve played have been any good. Despite that, I had both the urge to complete the game and discover how they work internally. As nearly all commercially developed games happen to be proprietary, I focused on viewing and extracting their asset files, an art not unlike reverse engineering of executable…
I’ve discovered a trivial stored XSS vulnerability in Checkmk 1.6.0p18 during an on-site penetration test and disclosed it responsibly to the tribe29 GmbH. The vendor promptly confirmed the issue, fixed it and announced an advisory. I’ve applied for a CVE, but didn’t get around explaining the vulnerability in detail, therefore I’m publishing this blog post to complete the process. Summary CVSS…
Note : The \037 sequence appearing in the code snippets is one character, escaped for readability. It’s been eight years since I started using Emacs and Emacs Lisp and I still keep running into dusty corners. Traditionally, Lisp dialects use the semicolon for line comments, with block and s-expression comments being optional features. Dialect Line comment Block comment S-expression comment…
Warning: Rant ahead. Feel free to skip the nstore backend section. Motivation I’ve spent the past year looking into the fungi kingdom and the deeper I look, the weirder it gets. One barrier of entry is identifying mushrooms, with two different schools of thought: Carefully observing their features and using a dichotomous key system to narrow down to a manageable set of matches. I found Michael…