Investigating Reported Vulnerabilities: A Closer Look!

Sun, 30 Jul 2023 00:00:00 +0000

In vulnerability scanners or penetration testing reports, you might come across statements like “Service version x.y.z is vulnerable to CVE-YYYY-ABCD.” However, it’s essential to delve deeper to confirm the actual vulnerability.

Let’s consider a real example:

We received a vulnerability report indicating a vulnerability (CVE-2023-23916) in curl v7.74.0 within the Debian 11 environment.

The CVE documentation mentions:

Affected versions: curl 7.57.0 to and including 7.87.0

At first glance, it appears that v7.74.0 is indeed vulnerable. But is that really the case?

NULLCON 2021 Training: DEVSECOPS

Sat, 27 Mar 2021 00:00:00 +0000

You don’t need money to buy expensive things, sometimes hard work pays off. And yes nullcon trainings are still expensive for me xD and I am grateful that I got this chance to attend one.

One year ago, I was going through the nullcon training schedule, and trying to understand the structure, and how much I can learn from it, because it was too expensive for me to get the actual training. Cut to March 1st , 2021, where I was attending a nullcon Training called – “DEVSECOPS – AUTOMATING SECURITY IN DEVOPS by Rohit Salecha”, not only as an attendee but also as a moderator for the event, because I was the one of the employees at Payatu.

Vulnerability-Management on krash.dev

Investigating Reported Vulnerabilities: A Closer Look!

NULLCON 2021 Training: DEVSECOPS