Results for "Authentication"
- Article
Why Gecko Isn’t an IaC Scanner, and What It Actually Does
Learn why Gecko Security isn’t an IaC scanning tool and what it actually does. Compare IaC scanners with application security testing.
- Article
Business Logic Is AppSec’s Unsolved Problem
Broken access control has been the #1 vulnerability class since 2021. This post explores why it’s unsolved, why it will get worse, and how LLMs can bridge the g…
- Article
CVE-2026-25055: n8n Arbitrary File Write on Remote Systems via SSH Node
Path traversal vulnerability in n8n’s Webhook node allows attackers to write files to arbitrary locations on remote servers connected via SSH.
- Article
Why Static Analysis Struggles with Business Logic Vulnerabilities
The gap between tracking where data flows and reasoning about whether the logic is correct.
- Article
How Broken Access Controls in Cal.com Leaked Millions of Bookings and Enabled Complete Account Takeover
Gecko’s AI security engineer discovered critical chained vulnerabilities in Cal.com Cloud that allowed complete account takeover and exposed all booking data.
- Article
CVE-2025-54381: BentoML SSRF in File Upload Processing
Server-side request forgery vulnerability in BentoML’s file upload processing system allowing arbitrary HTTP requests from the server.
- Article
CVE-2025-51479: ONYX Authorization Bypass in Enterprise Edition Group Management API
Authorization bypass vulnerability in ONYX Enterprise Edition allowing curators to manipulate groups outside their authorized scope.
- Article
CVE-2025-51464: Stored XSS in AIM Reports
Stored cross-site scripting vulnerability in AIM Reports allowing malicious Python code to execute arbitrary JavaScript in users’ browsers.
- Article
CVE-2025-51459: DB-GPT RCE in DB-GPT Plugin Upload System
Remote code execution vulnerability in DB-GPT’s plugin upload functionality through unsafe Python code execution.
- Article
CVE-2025-51462: Ragflow XSS in Dialog Configuration
Stored cross-site scripting vulnerability in Ragflow’s dialog configuration functionality allowing malicious HTML/JavaScript execution.
Showing 21 - 30 of 30 results