Posts in:

Security

Insecure Deserialization: Finding Java Vulnerabilities with QL

Deserialization of untrusted data can lead to vulnerabilities that allow an attacker to execute arbitrary code. We can use QL, the query language of LGTM, to find such deserialization vulnerabilities.

Github Security Features, Bluekeep, Nginx, and Security News - Semmle on Security

Fermin Serna and Oege de Moor discuss the latest security news and our take in Semmle on Security. In this episode, they break down the new Github security announcement, Bluekeep, CPU bugs, and more.

Open Security: The path to securing Open Source Software

Open source software (OSS) is both widely adopted but also comes with security risks. Learn how four projects are advancing an open security approach.

Threat Hunting At Microsoft: Using Semmle QL To Eliminate Bugs

Semmle appoints its first CSO to build out world-class security research team and lead product security

Denial of Service (DoS) Vulnerability in Facebook Fizz

Facebook Fizz integer overflow vulnerability (CVE-2019-3560)

BSides San Francisco wrapup

Data flow analysis and path exploration in LGTM

February 28, 2019

Introduction to variant analysis with QL and LGTM (Part 1)

First of a series of blog posts to explain what variant analysis is through a suite of QL exercises on LGTM, with ascending technical difficulty

February 19, 2019

Exploiting CVE-2018-19134: Ghostscript RCE through type confusion

This post describes how I used variant analysis to develop an exploit for Ghostscript CVE-2018-19134, a type confusion vulnerability that allows arbitrary shell command execution.

February 05, 2019

CVE-2018-19475: Ghostscript shell command execution in SAFER mode

January 14, 2019

Apple XNU exploits: ICMP proof of concept

November 24, 2018

Ghostscript Vulnerabilities in Postscript & PDF Processings

November 21, 2018

OGNL Apache Struts exploit: Weaponizing a sandbox bypass (CVE-2018-11776)

November 21, 2018

Apple XNU Vulnerabilities Affecting Macs, iPhones, and iPads

October 30, 2018

Kernel crash caused by out-of-bounds write in Apple's ICMP packet-handling code (CVE-2018-4407)

October 30, 2018

CVE-2018-4259: MacOS NFS vulnerabilties lead to kernel RCE

October 30, 2018

Apache Struts 2: Remote Code Execution Vulnerability

October 04, 2018

Apache Struts double evaluation RCE lottery

October 04, 2018

OGNL injection in Apache Struts: Discovering exploits with taint tracking

September 24, 2018

Apache Struts Vulnerability - CVE-2018-11776

August 22, 2018

Librelp buffer overflow fix (cve-2018-1000140) - a collaboration between Adiscon and Semmle

CVE-2018-4249 & CVE-2017-13904: Remote code execution in Apple's packet mangler

Apple NFS Diskless Boot: Negative integer overflow vulnerabilities (CVE-2018-4136 & CVE-2018-4160)

Etherpad reflected file download: Vulnerability hunting with QL (CVE-2018-6835)

CVE-2017-8046 exploit: Remote code execution affecting Pivotal Spring projects

Spring Data REST exploit (CVE-2017-8046): Finding a RCE vulnerability with QL

Android deserialization vulnerabilities: A brief history

February 02, 2018

Stack buffer overflow in Qualcomm MSM 4.4 - Finding bugs with QL

January 24, 2018

Castor and Hessian java deserialization vulnerabilities

January 17, 2018

XXE attack example using jBoss vulnerability (jBPM) CVE-2017-7545

December 19, 2017

Apple's XNU Kernel: Finding a memory exposure vulnerability with QL (CVE-2017-13782)

November 01, 2017

Restlet XXE vulnerability (CVE-2017-14949)

October 17, 2017

Restlet XML External Entity Expansion Vulnerability (CVE-2017-14868)

October 02, 2017

Spring AMQP Exploit (CVE-2017-8045): Remote Code Execution Vulnerability

September 20, 2017

Apache Struts Vulnerability (CVE-2017-9805) Found Using LGTM.com

September 05, 2017

CVE-2017-9805: How QL found a remote code execution vulnerability in Apache Struts

September 05, 2017

Browse all tags