iOS 0days, Apache Dubbo RCEs, and NPM bugs [Bounty Hunting]

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/ios-0days-apache-dubbo-rces-and-npm-bugs.html

Some of Apple's XPC services are leaking information, Finder has an RCE, and some CodeQL use to find many RCEs in Apache Dubbo.

[00:00:38] macOS Finder RCE

[00:06:11] AWS WorkSpaces Remote Code Execution [CVE-2021-38112]

[00:10:09] Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program

[00:26:51] 5 RCEs in npm for $15,000

[00:42:32] Apache Dubbo: All roads lead to RCE

The DAY[0] Podcast episodes are streamed live on Twitch (@dayzerosec) twice a week:

Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities

Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

The Video archive can be found on our Youtube channel: https://www.youtube.com/c/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

Or follow us on Twitter (@dayzerosec) to know when new releases are coming.