Achievements

Wild Animal Detection using YOLOv8

Brahm Dave, Meet Mori, Anurag Bathani, Parth Goel

Procedia Computer Science, Volume 230, 2023, Pages 100-111
ISSN 1877-0509

ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names

Discovered a High severity vulnerability in Gotenberg that allows arbitrary file rename and move via ExifTool dangerous tag blocklist bypass using group-prefixed tag names.

Privilege Escalation via Unrestricted serviceAccountName in the Kubernetes Backend

Discovered a High severity privilege escalation in Woodpecker CI: an unrestricted `serviceAccountName` in pipeline YAML let any user with push access run Kubernetes pods under an arbitrary — potentially cluster-admin — service account.

Blind SSRF in OAuth2 Avatar Synchronization via Unvalidated OIDC picture Claim

Reported a Low severity blind SSRF in Gitea's OAuth2 avatar sync: an unvalidated OIDC `picture` claim let a low-privileged user coax the server into fetching arbitrary internal URLs.