vulnerability disclosure

A practical checklist for writing a vulnerability disclosure policy: what to include, what UK product security law now requires, and how it differs from a bug bounty programme or a …

A chain of five vulnerabilities in the Markdown Preview Enhanced VS Code extension let a crafted markdown file write to files on a developer’s machine. All five are now patched.

Google’s Threat Analysis Group found a critical Zimbra XSS vulnerability in the Classic Web Client that lets a crafted email hijack a live session. Zimbra has patched it in version …