Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Gynvael Coldwind
Re: Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS)
Full Disclosure mailing list archives From: Gynvael Coldwind <gynvael () coldwind pl> Date: Tue, 14 Oct 2025 10:32:47 +0200 Finding 1: Excessive Data Exposure / JWT Token Leakage Attack Vector 1. User authenticates normally to suno.com 2. Malicious browser extension monitors network traffic 3. Extension intercepts API response from /v1/client/sessions/{session_id}/touch 4. Attacker extracts JWT token from JSON response body 5.
Re: Netgear Router Administrative Web Interface Lacks Transport Encryption By Default
Full Disclosure mailing list archives From: Gynvael Coldwind <gynvael () coldwind pl> Date: Sun, 16 Feb 2025 13:04:42 +0100 Hi, This isn't really a problem a vendor can solve in firmware (apart from offering configuration via cloud, which has its own issues).
Three vulnerabilities found in MikroTik's RouterOS
Full Disclosure mailing list archives By Date By Thread Re: Three vulnerabilities found in MikroTik's RouterOS From: Gynvael Coldwind <gynvael () coldwind pl> Date: Fri, 7 May 2021 18:09:20 +0200 Hi, I might be missing something, but how are these considered vulnerabilities? My point is that these require authentication, and an already authenticated user already has permissions to reboot the device anyway, right?
How to deal with reporters who don't want their bugs fixed?
oss-sec mailing list archives Re: How to deal with reporters who don't want their bugs fixed? From: Gynvael Coldwind <gynvael () coldwind pl> Date: Thu, 18 Jan 2018 17:06:04 +0000 Hi there, Speaking for myself from a security researcher's perspective, I would say it depends on the reason for embargo, and what ends up protecting users better.
"." (period) in file extension(s) in windows
From: Gynvael Coldwind Date: Tue, 02 Jan 2018 01:57:10 +0000 Hi there, It's the same with spaces btw (see also James Forshaw's mention of this in his post [1]): test Reading doesn't seem to work with Windows Subsystem for Linux (Windows 10) though :( $ cat asdf test $ cat "asdf . ... . .... . . " cat: 'asdf . ... . .... . . ': No such file or directory $ cat "asdf . . . . . ... " $ cat "asdf . . . . . ... " test2 And the file is listable on Windows (i.e. not WSL) too: asdf asdf . . . . . ...
Google Translator affected by Cross-Site Scripting vulnerability
From: Gynvael Coldwind Date: Fri, 27 Nov 2015 10:08:44 +0000 Hi Francisco, Unfortunately your disclosure is factually wrong. Please note that even the packet you are citing says "Host: translate.googleusercontent.com" - this is not the same domain as translate.google.es (or translate.google.com), therefore, due to the JavaScript same-origin policy ( https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it's a different origin.
Full Disclosure: Re: WinRAR SFX v5.21
From: Gynvael Coldwind Date: Mon, 28 Sep 2015 08:39:20 +0000 Correct me if I'm wrong, but the vulnerability can be summarized as: if you run an untrusted .exe you might execute malicious code? I hardly see this as giving anything new to the attacker who can just create a malicious exe file, set the winrar sfx icon and send it to the victim. Keep in mind that not every unexpected behavior or software bug is a security vulnerability.
Full Disclosure: Re: Google HTTP Live Headers v1.0.6
Hi, Quick question with regards to your disclosure - why are you attributing the ownership/authorship of HTTP Live Headers to Google? The website you linked seems to clearly says it's developed by eSolutions Nordic AB ("offered by https://www.esolutions.se").
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Gynvael
Contact Gynvael, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack