Erez Kalman

PDF Document Spoofing in DropBox Sign(HelloSign)

RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync

RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies

RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload

RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings

RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force

RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server

RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure

RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation

RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption