CVE — Myth and Reality
summary
Covers several recent real CVEs for high-load systems, showing the lifecycle from researcher discovery to exploitation and demonstrating an example of exploiting a CVE without a public exploit. Explains how to assess CVE severity and relevant parameters, and surveys resources and scanners to help detect vulnerable systems.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:15What are CVE and sources
- 4:44Personal vulnerability hunting
- 8:13Request smuggling attacks
- 9:39Python and SSRF flaws
- 11:25Deserialization exploits
- 12:30Django CSRF Bypass
- 14:15SSRF and Go flaws
- 15:43DDoS and Go flaws
- 16:49Security product flaws
- 17:56Finding and handling CVEs
- 20:26CVE myths and fixes
- 21:55Vulnerability protection processes
- 24:01ML for exploit generation
- 28:19Q&A
related talks
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?
30mThe Myth of the Meteoric Rise in Vulnerabilities
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
30mIdentifying Exploited and Likely-to-Be-Exploited Vulnerabilities
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
39mCVE 101: The Unfolding Of A Zero Day Attack
23mHitchhikers' Guide to the Vulniverse