Path Confusion and Mixing Public/Private Keys

Day[0]

Content provided by dayzerosec. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by dayzerosec or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://staging.podcastplayer.com/legal.

2M ago 59:34

MP3•Episode home

This week's episode features a variety of vulnerabilities, including a warning on mixing up public and private keys in OpenID Connect deployments, as well as path confusion with an nginx+apache setup.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/275.html

[00:00:00] Introduction

[00:19:00] The OOB Read zi Introduced

[00:16:55] Mixing up Public and Private Keys in OpenID Connect deployments

[00:22:51] Nginx/Apache Path Confusion to Auth Bypass in PAN-OS [CVE-2025-0108]

[00:31:50] Hacking High-Profile Bug Bounty Targets: Deep Dive into a Client-Side Chain

[00:44:14] Uncovering Apple Vulnerabilities: diskarbitrationd and storagekitd Audit Part 3

[00:48:48] GigaVulnerability: readout protection bypass on GigaDevice GD32 MCUs

[00:56:57] Attempted Research in PHP Class Pollution

Podcast episodes are available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

281 episodes

#Tech #dayzerosec