The Curious Engineer

All blogs / Security

Positive Security

positive.security/blog

Findings from our IT Security research, industry insights from our work, and other interesting bits.

SecurityAI / MLReverse engineering

’21’22’23’24’25’26
Posts
14 from 15 Apr 2021 to 10 Aug 2026
Posting
now and then (1 in the last year)
Kind
company blog
Feed
http://positive.security/blog/rss.xml

2026 1

  1. Banking AI XSS: The exploit is in the payment referenceAugust 10, 2026Our bank's AI Agent was vulnerable to Cross-Site Scripting and Indirect Prompt Injection, leading to session compromise via malicious PDFs or transaction references.Read more...

2025 2

  1. Vulnerabilities in the hidden magic of Lodash, Ramda and UnderscoreMay 7, 2025We looked at the internals of JavaScript/TypeScript's most popular utility libraries and found interesting issues. The post contains hacking challenges/live demos. We recommend checking it out if you work with the affected
  2. BlinkenCity: From Art Project to Europe-wide Blackout ScenarioJanuary 10, 2025A significant portion of Europe's renewable energy production can be remotely controlled via longwave radio. While this system is intended to stabilize the grid, it can also be abused to destabilize it by remotely toggling

2023 2

  1. Hacking Auto-GPT and escaping its docker containerJune 29, 2023We leverage indirect prompt injection to trick Auto-GPT (GPT-4) into executing arbitrary code when it is asked to perform a seemingly harmless task such as text summarization on a malicious website, and discovered vulnerabilities that al
  2. Ransacking your password reset tokensJanuary 26, 2023We demonstrate how the popular "Ransack" library (Ruby on Rails) can be abused to exfiltrate sensitive data via character by character brute-force, allowing for a full application compromise in some cases. An internet wide search identifies severa

2022 4

  1. urlscan.io's SOAR spot: Chatty security tools leaking private dataNovember 2, 2022We explore the security service urlscan.io and showcase through various "dorks" that their searchable scan database is a treasure trove of URLs pointing to sensitive user information, allowing account takeover, and muc
  2. From XSS to RCE (dompdf 0day)March 16, 2022Using a still unpatched vulnerability in the PHP library dompdf (used for rendering PDFs from HTML), we achieved RCE on a web server with merely a reflected XSS vulnerability as entry point.Read more...
  3. Find You: Building a stealth AirTag cloneFebruary 21, 2022We built an AirTag clone capable of silently and continuously tracking someone. The device accomplishes this by sending just one beacon per generated public key, thereby staying invisible to tracking notifications for iOS users and Apple’s Tr
  4. Recovering redacted information from pixelated videosJanuary 25, 2022We explore the history of image unblurring and present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved).Read more...

2021 5

  1. MS Teams: 1 feature, 4 vulnerabilitiesDecember 22, 2021Microsoft Team's link preview feature is susceptible to spoofing and vulnerable to Server-Side Request Forgery. Team's Android users can be DoS'ed and, in the past, their IP address could be leaked.Read more...
  2. Windows 10 RCE: The exploit is in the linkDecember 7, 2021Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms
  3. Linux marketplaces vulnerable to RCE and supply chain attacksJune 22, 2021We're disclosing patched vulnerabilities in KDE Discover and the Gnome Shell Extensions website, as well as unpatched vulnerabilities in the PlingStore app and Pling-based Linux marketplace websites (e.g. appimagehub.com, stor
  4. Send My: Arbitrary data transmission via Apple's Find My networkMay 12, 2021Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices. We're releasing an ESP32 firmware that turns the microcontroller into an (upload on
  5. Allow arbitrary URLs, expect arbitrary code executionApril 15, 2021Insecure URL handling leading to 1-click code execution vulnerabilities in Telegram, Nextcloud (CVE-2021-22879), VLC, LibreOffice (CVE-2021-25631), OpenOffice (CVE-2021-30245), Bitcoin/Dogecoin Wallets, Wireshark (CVE-2021-22191) and