Walter Moar·3d agoUnderstanding CWE-321: Use of Hard-coded Cryptographic KeyLearn how CWE-321 lets attackers forge tokens, decrypt traffic, and impersonate users once a cryptographic key is extracted from source…
Walter Moar·Nov 2Understanding CWE-184: Incomplete List of Disallowed InputsLearn how CWE-184 lets attackers slip past a filter by finding the one dangerous value the developer forgot to list, from file extension…
Walter Moar·Oct 29Understanding CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval…Learn how CWE-95 lets attackers run arbitrary code when user input reaches eval() or similar dynamic-evaluation functions, from calculator…
InDisarming DisinformationbyAdam·Oct 27Tracking Vulnerabilities using DISARMA CWE-inspired structure for tracking vulnerabilities in DISARM v2, starting with Data Voids.
InSystem WeaknessbyWalter Moar·Oct 15Understanding CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS…Learn how CWE-78 lets attackers run arbitrary shell commands when user input is concatenated into a system call, from ping utilities to…
