Alexander V. Leonov

Hello everyone! This episode will be about the AM Live Vulnerability Management online conference. I participated in it on May 17th. Alternative video link (for Russia): https://vk.com/video-149273431_456239090 The event lasted 2 hours. Repeating everything that has been said is difficult and makes little sense. Those who want can watch the full video or read the […]

Hello everyone! This episode will be about Microsoft Patch Tuesday for May 2022. Sorry for the delay, this month has been quite intense. As usual, I’m using my Vulristics project and going through not only the vulnerabilities that were presented on May 10th, but all the MS vulnerabilities presented by Microsoft since the previous Patch […]

Hello everyone! In this episode, I want to talk about the latest updates to my open source vulnerability prioritization project Vulristics. Alternative video link (for Russia): https://vk.com/video-149273431_456239088 CVSS redefinitions A fairly common problem: we have a CVE without an available CVSS vector and score. For example, this was the case with CVE-2022-1364 Type Confusion in […]

Hello everyone! This video was recorded for the VMconf 22 Vulnerability Management conference, vmconf.pw. I will be talking about malicious open source and the cost of using someone else’s code. Alternative video link (for Russia): https://vk.com/video-149273431_456239086Video in Russian from CISO Forum 2022: https://youtu.be/LPXg-MEamVA To be honest, at the beginning of the year I did not […]

Hello everyone! This episode will be about Microsoft Patch Tuesday for April 2022 and new improvements in my Vulristics project. I decided to add more comment sources. Because it’s not just Tenable, Qualys, Rapid7 and ZDI make Microsoft Patch Tuesday reviews, but also other security companies and bloggers. Alternative video link (for Russia): https://vk.com/video-149273431_456239085 You can […]

Hello everyone! After a two-year break, I took part in Moscow CISO Forum 2022 with a small talk “Malicious open source: the cost of using someone else’s code”. Alternative video link (for Russia): https://vk.com/video-149273431_456239084 CISO Forum is the first major Russian conference since the beginning of The New Reality of Information Security (TNRoIS). My presentation […]

Hello everyone! In this episode, let’s take a look at the latest vulnerabilities in Gitlab. On March 31, the Critical Security Release for GitLab Community Edition (CE) and Enterprise Edition (EE) was released. GitLab recommends that all installations running a version affected by the issues described in the bulletin are upgraded to the latest version as soon […]

Hello everyone! This episode will be about last week’s high-profile vulnerabilities in Spring. Let’s figure out what happened. Alternative video link (for Russia): https://vk.com/video-149273431_456239078 Of course, it’s amazing how fragmented the software development world has become. Now there are so many technologies, programming languages, libraries and frameworks! It becomes very difficult to keep them all in […]

Hello everyone! In this episode, I would like to talk about Github and how to remove sensitive information that was accidentally uploaded there. Alternative video link (for Russia): https://vk.com/video-149273431_456239077 This is a fairly common problem. When publishing the project code on Github, developers forget to remove credentials: logins, passwords, tokens. What to do if this becomes […]

Hello everyone! I am glad to greet you from the most sanctioned country in the world. Despite all the difficulties, we carry on. I even have some time to release new episodes. This time it will be about Microsoft Patch Tuesday for March 2022. Alternative video link (for Russia): https://vk.com/video-149273431_456239076 I do the analysis as […]