Blog
Notes on appsec, vulnerability research, and weird bugs
Long-form posts and short technical notes from my work in application security and vulnerability research.
Latest posts
Notes from the last few years. Newest first.
-
Ranked #35 in Microsoft's Most Valuable Security Researchers list
A short note linking to Microsoft's 2019 MSRC Most Valuable Security Researchers announcement.
-
Oracle Outside-In Technology SDW File Processing Buffer Overflow Vulnerability
Technical writeup of a heap-based buffer overflow in Oracle Outside-In Technology's vssdw.dll triggered by a malformed StarWriter (SDW) file, fixed in the October 2016 Oracle Critical Patch Update.