CVE-2021-44228
Apache Log4j
How a logging feature turned untrusted text into a path to remote code execution.
UNTRUSTED INPUTLOOKUP ENGINEOUTSIDE THE APP
When data becomes an instruction.
2 min readNot locally tested
Read the write-up THE READING ROOM / SAMPLE EDITION
Inside the critical path.
Historical CVEs, brought together to preview the reading experience.
03CRITICAL CVEs
2 original · 1 external
2 original · 1 external
SAMPLE
This is a demo edition with historical CVEs, not this week's news. Articles are source-based examples; no local reproduction is claimed. Create a live edition
CVE-2019-10744
Lodash
Understanding prototype pollution: when merging an object changes more than that object.
2 min readSource analysis only
Read the write-up CVE-2024-3094
XZ Utils
A backdoor in the software supply chain. Read the original technical investigation that exposed it.
Andres Freund · oss-securityExternal article
Read the original DEPTH OVER VOLUME
We follow the evidence.
When someone has already explained it well, we send you their way.