JANISSARY: A Differential DAST Tool Aimed at Verified, Actionable Security Findings

·1 views

A developer is building JANISSARY, a differential Dynamic Application Security Testing tool designed to make security testing results more meaningful and evidence-driven. The project separates initial discovery of unusual application behaviour from the verification of actual vulnerabilities. Its stated principles include transparency about whether outcomes are verified, unproven or inconclusive, and prioritising useful findings over sheer volume. The developer plans to share progress, technical decisions and lessons learned publicly via GitHub as the tool evolves.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

INFINITT PACS System Manager Flaws Allow Local Privilege Escalation and Code Execution

CERT/CC published advisory VU#203719 on November 2, 2026, describing two code execution vulnerabilities in INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5. The first, CVE-2026-16305, stems from weak file permissions on execlist.txt, which a low-privileged local user could modify so that an approved update runs added commands with administrative privileges. The second, CVE-2026-16306, affects the imodular:// URI handler in IModular.exe, which executes commands from crafted links without validating them, letting an attacker run code with the user's privileges when a victim opens a malicious link. INFINITT Healthcare lists versions 3.0.12.3 and 3.0.12.5 as fixed. The advisory reports no evidence of exploitation, but administrators are advised to check versions, file permissions and URI handler registration on PACS workstations. Interim measures include restricting local logons and shared use, limiting reachable network shares and blocking malicious URI links where possible.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Supreme Court to Hear Apple's Appeal in Epic Games Contempt Case

The U.S. Supreme Court is set to hear oral arguments on January 11, 2027, in Apple Inc. v. Epic Games, Inc. The case concerns whether Apple should be held in civil contempt for allegedly violating the spirit of a court injunction that removed its commission on purchases made outside the App Store. Apple contends the injunction's wording did not explicitly bar commissions on external sales, while Epic argues the continued fees undermine the order's purpose. The Court will not decide whether Apple may charge such commissions, an issue still pending in lower courts. The ruling could set a precedent for how injunctions against major tech platforms are interpreted.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Salesforce Custom Metadata Types vs Custom Settings: Choosing the Right Option

Salesforce developers often mix up Custom Settings and Custom Metadata Types, though they store configuration differently. Custom Settings hold org-specific data that is not deployed with code, and their Hierarchy variant can vary values by profile or user. Custom Metadata Types are deployed as metadata through change sets, packages, and the Metadata API, so they move reliably between environments. Custom Metadata cannot be modified by Apex at runtime and has no per-user cascade, so it suits deployment-time settings only. The article recommends a simple rule: use Custom Metadata for stable configuration and Custom Settings or custom objects for values that change at runtime.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sådan bygger du en gennemsigtig prisberegner med HTML og JavaScript

En tutorial på DEV Community viser, hvordan man bygger en simpel prisberegner med HTML og vanilla JavaScript uden frameworks. Værktøjet fokuserer på tydelige beregninger, en forståelig visning af moms og ærlig kommunikation om usikkerhed. Brugeren indtaster selv forventede timer, timepris og ekstra ydelser, og beregneren lægger beløbene sammen med en forenklet momssats på 25 procent. Artiklen understreger, at værktøjet kun er et undervisningseksempel og ikke et bindende tilbud, eftersom faktorer som maskiner, transport og bemanding ikke indgår. Forfatteren skelner desuden mellem beregning af et beløb og en faglig vurdering af træfældning, hvor sidstnævnte ikke automatiseres.

0 comments Read more at DEV Community