@thecyberchanakya

Amal P

@thecyberchanakya

Digital defense, inspired by ancient strategy.

Kerala, IndiaJoined June 2025

About

Nothing here yet.

Available for

Nothing here yet.

Amal P's blogs

The Cyber Chanacyablog.interintender.com18 posts

Articles Comments

Recently published

APAmal Pblog.interintender.comSep 17, 2025 · 4 min read

Grafana — CVE-2024-9264

TL;DR CVE-2024-9264 is a critical vulnerability in Grafana 11.x where the SQL Expressions feature forwards attacker-controlled SQL to a backend (DuckDB), enabling local file reads (LFI) and, in some setups, remote code execution (RCE). In many config...

APAmal Pblog.interintender.comSep 14, 2025 · 4 min read

CVE-2024-4956 — Nexus Repository 3 Path Traversal (no login needed)

TL;DR What: An unauthenticated path traversal in Sonatype Nexus Repository 3 lets anyone craft a URL that makes Nexus return any file on the server—even outside the app folder. No login required. Fixed in 3.68.1. Affected: All Nexus Repository 3.x ...

APAmal Pblog.interintender.comSep 13, 2025 · 4 min read

Jenkins with no login — CVE-2024-23897

TL;DR What: A flaw in the Jenkins CLI lets an attacker read files on the Jenkins server using a special “@file” trick in command arguments. In many setups, this works without logging in (unauthenticated), though it may initially reveal only the firs...

APAmal Pblog.interintender.comSep 12, 2025 · 3 min read

SSRF — When a Server Makes the Wrong Call

TL;DR What: SSRF happens when an application lets a user supply a URL, and the server fetches it. Why it’s bad: The server sits inside a trusted network, so it can be tricked into calling localhost or internal services you can’t reach from the inte...

APAmal Pblog.interintender.comSep 11, 2025 · 4 min read

CVE-2025-54236 (aka “SessionReaper”) — What it is, why it matters, and how to fix it

TL;DR What: A critical bug in Adobe Commerce / Magento Open Source that lets an attacker take over customer accounts via the Commerce API (no login or clicks needed). Severity: CVSS 9.1 — High impact to confidentiality and integrity; no user intera...

Amal P

About

Available for

Amal P's blogs

Recently published

Grafana — CVE-2024-9264

CVE-2024-4956 — Nexus Repository 3 Path Traversal (no login needed)

Jenkins with no login — CVE-2024-23897

SSRF — When a Server Makes the Wrong Call

CVE-2025-54236 (aka “SessionReaper”) — What it is, why it matters, and how to fix it

Search Hashnode

Amal P

About

Available for

Amal P's blogs

Recently published

Grafana — CVE-2024-9264

CVE-2024-4956 — Nexus Repository 3 Path Traversal (no login needed)

Jenkins with no login — CVE-2024-23897

SSRF — When a Server Makes the Wrong Call

CVE-2025-54236 (aka “SessionReaper”) — What it is, why it matters, and how to fix it