211 - OverlayFS to Root and Parallels Desktop Escapes [Bug Bounty Podcast]

More bug bounty style bugs, but you'd be forgiven reading that title thinking we had a low-level focus this episode. We got some awesome bugs this week though from tricking Dependabot and abusing placeholder values, an IIS auth bypass. Ending off with a kernel bug (OverlayFS) and a VM escape (Parallels Desktop)

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/211.html

[00:00:00] Introduction
[00:00:28] Dependabot Confusion: Gaining Access to Private GitHub Repositories using Dependabot
[00:12:39] Placeholder for Dayzzz: …

abusing auth bounty bug bug bounty bugs bypass dependabot desktop focus iis kernel kernel bug low parallels podcast root thinking