Video yükleniyor...

Video Yüklenemedi

Bu video yüklenirken bir sorun oluştu. Bu geçici bir ağ sorunundan kaynaklanıyor olabilir veya video kullanılamıyor olabilir.

Ana Sayfaya Dön

And here's postgres bidirectional RCE no admin required, client infects server, server infects client ♻️🐛

V12

9,814 subscribers

185,886 görüntüleme • 3 ay önce •via X (Twitter)

Haberler & Politika Bilim & Teknoloji

Anya Rossi• Live Now

Private livecam show

15 Yorum

V12 profil fotoğrafı

V123 ay önce

found using V12 by @rdjgr of the V12 security team V12 is our autonomous AI hacker. You can find bugs like this in your code: song: if your boyfriend was a songwriter by realina

YogSotho profil fotoğrafı

YogSotho3 ay önce

Where's PoC? Technical details?

ᑯƌǨ profil fotoğrafı

ᑯƌǨ3 ay önce

cant even get a fucking day off without having to patch and upgrade something

Sylvie profil fotoğrafı

Sylvie3 ay önce

how much time did it take to find this? y'all have really been in the zone recently...

thingwhere profil fotoğrafı

thingwhere3 ay önce

Are you able to say what versions of postgres this impacts yet?

V12 profil fotoğrafı

V123 ay önce

this is a 26 year old vulnerablity

thingwhere profil fotoğrafı

thingwhere3 ay önce

Yikes. Are you able to confirm if it needs a valid client auth to be abused or if simply being exposed to non-auth connection would be vuln?

kernelstub (Prepakis Georgios) profil fotoğrafı

kernelstub (Prepakis Georgios)3 ay önce

Forgot the brainrot </3

Hannah Genie profil fotoğrafı

Hannah Genie3 ay önce

There goes my weekend. Two wormable bidirectional database RCEs in one cycle, and HackerOne still has not triaged the first one after two weeks.

.hxrtcamilla profil fotoğrafı

.hxrtcamilla3 ay önce

any details??? link to poc?

V12 profil fotoğrafı

V123 ay önce

this shit is stuck in disclosure. Very sad

DK profil fotoğrafı

DK3 ay önce

Can you turn down the fucking music next time

V12 profil fotoğrafı

V122 ay önce

poc for postgres server RCE: CVE-2026-14669. patched postgreSQL 18.6.

x1a0 profil fotoğrafı

x1a02 ay önce

pycrypto?

Sebastian Buzdugan profil fotoğrafı

Sebastian Buzdugan3 ay önce

no admin is secondary if port 5432 is not reachable from untrusted clients

Benzer Videolar

Client/Server composition with server components feels illegal 😅

Client/Server composition with server components feels illegal 😅

Alex Sidorenko

69,174 görüntüleme • 2 yıl önce

Moving data fetching between client and server with SWR

Moving data fetching between client and server with SWR

Alex Sidorenko

33,446 görüntüleme • 1 yıl önce

opencode's client/server architecture is important we're making quick server management smoother

opencode's client/server architecture is important we're making quick server management smoother

David Hill

64,317 görüntüleme • 9 ay önce

Your AI stack just stopped being closed. 🔓 TanStack AI now speaks AG-UI client-to-server. - The same client hits any AG-UI server. - Any AG-UI client hits a TanStack server. Zero breaking changes. Migration guide in the tweet below 👇

Your AI stack just stopped being closed. 🔓 TanStack AI now speaks AG-UI client-to-server. - The same client hits any AG-UI server. - Any AG-UI client hits a TanStack server. Zero breaking changes. Migration guide in the tweet below 👇

TANSTACK

79,086 görüntüleme • 5 ay önce

Server authoritative movement with client prediction and rollback/replay support. In this example, the client exploits by moving a wall out of the way. But the server owns the movement. The client has failed predictions due to the exploit, and rolls back. #RobloxDev

Server authoritative movement with client prediction and rollback/replay support. In this example, the client exploits by moving a wall out of the way. But the server owns the movement. The client has failed predictions due to the exploit, and rolls back. #RobloxDev

sleitnick

20,583 görüntüleme • 1 yıl önce

New Expo example: graphQL server and client with ✨automatic type generation✨! 🧘‍♀️ GraphQL Yoga - server 💜 URQL - client 🎉 gql.tada - type generation ☁️ EAS Hosting - for API & web deployments

New Expo example: graphQL server and client with ✨automatic type generation✨! 🧘‍♀️ GraphQL Yoga - server 💜 URQL - client 🎉 gql.tada - type generation ☁️ EAS Hosting - for API & web deployments

Kadi Kraman 💚

17,470 görüntüleme • 1 yıl önce

❌ Don't import server components directly from client components ✅ Instead send them as props to client components

❌ Don't import server components directly from client components ✅ Instead send them as props to client components

George Moller

42,762 görüntüleme • 3 yıl önce

Streaming data from server to client with "use" in Next.js

Streaming data from server to client with "use" in Next.js

Alex Sidorenko

37,119 görüntüleme • 1 yıl önce

When to use Server vs Client components in Next.js 13

When to use Server vs Client components in Next.js 13

Alex Sidorenko

148,190 görüntüleme • 3 yıl önce

🧵1/2 Socket Programming in C: Server-Side Basics - Set up a server using socket(), bind(), and listen(). - Accept client connections with accept(). - Send and receive data over TCP. Video 1: Server-Side in C! Video 2: Client-Side Programming will be uploaded soon—stay tuned! 🖥️

🧵1/2 Socket Programming in C: Server-Side Basics - Set up a server using socket(), bind(), and listen(). - Accept client connections with accept(). - Send and receive data over TCP. Video 1: Server-Side in C! Video 2: Client-Side Programming will be uploaded soon—stay tuned! 🖥️

trish

2,925,659 görüntüleme • 1 yıl önce

How to refactor an existing client component into a server component? 1. Move the state to the URL 2. Move data fetching to the server 3. Isolate interactivity into a smaller client component

How to refactor an existing client component into a server component? 1. Move the state to the URL 2. Move data fetching to the server 3. Isolate interactivity into a smaller client component

Alex Sidorenko

112,401 görüntüleme • 3 yıl önce

If you’re playing on MonkeyTilt, the outcome might already be decided BEFORE you bet “The cryptography behind every bet has always been sound” We tested it It isn’t... we sent two different client seeds for the same nonce same result both times the server is ignoring the client seed entirely the player has ZERO influence on outcomes — what we did — opened the MonkeyTilt provably fair verifier with a revealed server seed entered nonce 1 → got 3.04x changed the client seed same server seed, same nonce → 3.04x changed it again → 3.04x the client seed has ZERO effect on the outcome — why this matters — in a provably fair system the outcome is derived from: -server seed -client seed -nonce the client seed exists so the player contributes randomness the server CAN’T predict if it’s ignored the server knows every outcome BEFORE you bet the hash commitment proves nothing because the server already controls all the inputs — not a frontend bug — we checked the network traffic the verifier sends a WebSocket request with: -client seed -server seed -nonce the server receives different client seeds and returns the same result anyway request 1 → client_seed “Clientseed123456789” → 3.04x request 2 → client_seed “NEWSEED12345” → 3.04x this is the server ignoring input not a display issue — live bet traffic — placing a Limbo bet returns: -random_multiplier -total_payout -round_closed that’s it no hash no seed reference no nonce no proof seeds are fetched from a separate endpoint game engine and seed system are DISCONNECTED — nonce verification — you can only verify nonces you’ve already played in a real system all outcomes are predetermined once the server seed is committed - they’re deterministic blocking future nonces suggests results don’t exist until you bet — summary — -client seed ignored by server -no cryptographic proof in bet responses -game engine and seed system DISCONNECTED -nonce verification restricted this isn’t provably fair it looks like provably fair UI on top of server side RNG MonkeyTilt should probably address this anyone can verify this themselves in 60 seconds - open the verifier, change the client seed, watch the result stay the same

If you’re playing on MonkeyTilt, the outcome might already be decided BEFORE you bet “The cryptography behind every bet has always been sound” We tested it It isn’t... we sent two different client seeds for the same nonce same result both times the server is ignoring the client seed entirely the player has ZERO influence on outcomes — what we did — opened the MonkeyTilt provably fair verifier with a revealed server seed entered nonce 1 → got 3.04x changed the client seed same server seed, same nonce → 3.04x changed it again → 3.04x the client seed has ZERO effect on the outcome — why this matters — in a provably fair system the outcome is derived from: -server seed -client seed -nonce the client seed exists so the player contributes randomness the server CAN’T predict if it’s ignored the server knows every outcome BEFORE you bet the hash commitment proves nothing because the server already controls all the inputs — not a frontend bug — we checked the network traffic the verifier sends a WebSocket request with: -client seed -server seed -nonce the server receives different client seeds and returns the same result anyway request 1 → client_seed “Clientseed123456789” → 3.04x request 2 → client_seed “NEWSEED12345” → 3.04x this is the server ignoring input not a display issue — live bet traffic — placing a Limbo bet returns: -random_multiplier -total_payout -round_closed that’s it no hash no seed reference no nonce no proof seeds are fetched from a separate endpoint game engine and seed system are DISCONNECTED — nonce verification — you can only verify nonces you’ve already played in a real system all outcomes are predetermined once the server seed is committed - they’re deterministic blocking future nonces suggests results don’t exist until you bet — summary — -client seed ignored by server -no cryptographic proof in bet responses -game engine and seed system DISCONNECTED -nonce verification restricted this isn’t provably fair it looks like provably fair UI on top of server side RNG MonkeyTilt should probably address this anyone can verify this themselves in 60 seconds - open the verifier, change the client seed, watch the result stay the same

CoinBets🔍

20,973 görüntüleme • 7 ay önce

"How to share state between React client components with a parent server component?" 👇

"How to share state between React client components with a parent server component?" 👇

Alex Sidorenko

51,557 görüntüleme • 1 yıl önce

Here's how to deploy your own MCP server in 30 seconds: 1. Remix the Replit template 2. Prompt Agent "create a server that does xyz" 3. Select "Publish" Voila - a streamable HTTP server deployed with API key auth Connect to your sever in your client of choice

Here's how to deploy your own MCP server in 30 seconds: 1. Remix the Replit template 2. Prompt Agent "create a server that does xyz" 3. Select "Publish" Voila - a streamable HTTP server deployed with API key auth Connect to your sever in your client of choice

matt palmer

80,137 görüntüleme • 11 ay önce

If you want to be able to call server functions from the client, RPC is often the move. The Bun + Better Call combo gets you a fullstack solution in very little code. Server, Client, bundling and HMR 👌 had to record a little video showing the setup

If you want to be able to call server functions from the client, RPC is often the move. The Bun + Better Call combo gets you a fullstack solution in very little code. Server, Client, bundling and HMR 👌 had to record a little video showing the setup

Wes Bos

103,806 görüntüleme • 1 yıl önce

Reminder that your benchmark latencies don't mean anything if I don't know precisely where the client and server are located.

Reminder that your benchmark latencies don't mean anything if I don't know precisely where the client and server are located.

Ben Dicken

62,041 görüntüleme • 29 gün önce