Zach Daniel

Terminal escape sequence injection in Hex via unneutralized server-supplied output

Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization

Authorization bypass when bypass policy condition evaluates to true

Before action hooks may execute in certain scenarios despite a request being forbidden

Missing Session Revocation on Logout in ash_authentication_phoenix

Filter expression injection via forged keyset pagination cursor in Ash

Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Private action arguments can be set by user input in Ash