@SRMish
Joined November 2012
  • Tweets22
  • Following29
  • Followers50
Shachar Menashe retweeted
JFrog
@jfrog12 Mar 2025
For TensorFlow-based Keras #ML models, a major deserialization issue was given the identifier #CVE-2024-3660. Exploiting this issue allows attackers to inject and execute arbitrary code by crafting a malicious #Keras model file even when operating in Safe Mode. Deep dive into this new vulnerability: jfrog.co/3XLMLqh
3
3
249
If anybody missed our BlackHat USA 2024 talk about vulnerabilities in MLOps platforms - here are our full research findings!
JFrog Security
@JFrogSecurity20 Aug 2024
Resulting in 20+ disclosed CVEs to #ML vendors, our team explored the attacks that could be mounted on open source machine learning (#MLOps) platforms used inside organizational networks. Check out the top learnings and findings here: jfrog.co/3yKNA9H
1
4
153
Shachar Menashe retweeted
almog boker
@bokeralmog19 Jun 2024
דגל בגודל של 17 מטרים על 12 מטרים, הדגל הגדול ביותר בישראל, הונף כעת בנקודה שבה חדרו המחבלים הנאצים מחמאס ורצחו 20 מתושבי נתיב העשרה: מסביב לדגל נשתלו 20 עצי זית עתיקים על שמם ולזכרם של הניספים. הדרך עוד ארוכה, אבל אנחנו כאן. ומהיום בכל פעם שהמחבלים הארורים ירימו את הראש הם יראו את דגל ישראל ויבינו שאנחנו לא הולכים לשום מקום 🇮🇱 . תודה לאיתי לוי ולמושב נתיב העשרה על היוזמה, התכנון והביצוע ולחברת ההיטק JFrog שמימנה ותרמה צילום: אמנון זיו
145
137
35
2,315
76,556
What are you basing this statement on? Do you have a working RCE PoC on an embedded appliance? Also - 1. It's prior to 3.0.7 (3.0.6 is still vulnerable) 2. It is highly unlikely that an embedded appliance will be running OpenSSL 3.x 3. See this - github.com/colmmacc/CVE-2022…
hacker.house
@hackerfantastic1 Nov 2022
Replying to @hackerfantastic
Many are downplaying this weakness as unlikely to be exploited, however this is incorrect and are many situations - particularly within embedded appliances - where this vulnerability may be triggered and given 4-byte controlled write, exploitation risk on embedded systems is high
2
1
Check out my research collaboration with @andre_colonel where we scanned 8+ MILLION OSS packages to find thousands of active API tokens! Guess how many of those were admin tokens😱 infoworld.com/article/367683…

Public package repos expose thousands of API security tokens—and they’re active

JFrog’s new Xray Secrets Detection uncovered active access tokens in popular open-source software registries including Docker, npm, and PyPI. Here are our findings and takeaways.

infoworld.com
1
We uncovered a couple new malware families floating around on PyPI! Check it our technical analysis
JFrog
@jfrog30 Jul 2021
JFrog uncovered multiple malicious packages in the #PyPI #Python repository, exploiting developers for data theft, remote code injections, and leaking credit cards. Find out all the details in our new blog post. jfrog.co/3zRhuUM
PSA - Busybox's wget will silently accept any SSL certificate when downloading over HTTPS (yes, even self signed ones)
JFrog Security
@JFrogSecurity22 Jun 2020
Despite a high severity score, a #vulnerability was not patched because it could break existing functionality. Our latest post reviews this situation and why it is unacceptable to sacrifice #security in favor of functionality and release insecure code. hubs.ly/H0rHxSb0
1
Load more