Ivanti-EPM-Coercion-Vulnerabilities

Ivanti EPM Coercion Vulnerabilities Proof of concept exploits for Ivanti EPM CVE-2024-13159 and others which allows for unauthenticated coercion of the Ivanti EPM machine credential for use in relay attacks. Blog Post Deep-dive analysis here:...

CVE-2019-10149

CVE-2019-10149 - Exim 4.87 Local/Makefile cp eximmonitor/EDITME Local/eximon.conf Create exim user and group sudo groupadd -g 31 exim sudo useradd -d /dev/null -c "Exim Daemon" -g exim -s /bin/false -u 31 exim Install dependencies sudo apt-get update sudo apt-get install -y make build-essential...

R2Socks

R2Socks SOCKS5 proxy tunneled through Cloudflare R2 buckets. Client App ◄─SOCKS5─► Proxy ◄─── R2 Bucket ───► Agent ◄─TCP─► Target The proxy runs a local SOCKS5 server on the operator's machine. Every CONNECT request is serialized as binary packets and stored as R2 objects. The agent polls the sam...

CVE-2020-5148

CVE-2020-5148 Forced Authentication in the SonicWall UTM SSO Agent The SonicWall SSO Agent identifies the user behind a given IP address by probing that workstation with NetAPI the default or WMI. It does not validate the workstation before initiating the NTLM authentication, and it continues...

CVE-2023-23397-Report

CVE-2023-23397-Report An exploitation demo of Outlook Elevation of Privilege Vulnerability CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB TCP 445 share on a threat...

PetitPotam-notest

PetitPotam NTLM Relay Attack Detection A Zeek package for detecting some attempts to trigger NTLM relay attacks via the Petit Potam exploit. This package will detect what appear to be successful and unsuccessful exploit attempts. It makes a distinction between them by examining the return code fo...

cyanide

What is Cyanide? As the name suggests, it's poison. Cyanide is essentially a tracker for correlating various poisoning techniques currently only Responder is used in conjuction with relaying the captured hashes via Impackets ntlmrelayx.py. On startup it will start Responder without SMB, HTTP, or...

CVE-2026-33715

CVE-2026-33715 — Unauthenticated SSRF + Open Email Relay in Chamilo LMS via install.ajax.php Severity : High CVSS 7.2 CWE : CWE-918 SSRF + CWE-306 Missing Authentication Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-mxc9-9335-45mc NVD :...

Fourteen_Endpoints

The Middlemen Shell Companies Inside Apple's Privacy Relay An anonymous Delaware LLC publishes a Bible prayer app, a daily journal, and a caller ID tool on the App Store. That entity operates encrypted relay infrastructure inside Apple's privacy network. That relay terminates at Taiwan Mobile Co....

CVE-2026-100835

CVE-2026-100835 — Contrast attestation relay aTLS Python 3 PoC for CVE-2026-100835 — Edgeless SystemsContrast before 1.16.0. Description PoCbit / GitHub CVE-2026-100835 — Remote attestation relay against Contrast attested TLS aTLS CWE-295. Before 1.16.0 , Contrast treated any cryptographically...

CVE-2023-23397

CVE-2023-23397 Exploitation & Mitigation Demo 📌 Overview This project demonstrates the detection, exploitation, and mitigation of CVE-2023-23397 , a critical zero-click NTLM relay vulnerability in Microsoft Outlook for Windows. Exploited via calendar invites, this vulnerability allows attackers t...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool v9 Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool v9 Software as a Service Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation...

CVE-2025-33073

CVE-2025-33073 PoC Exploit for the NTLM reflection SMB flaw. All credits go to the offical research: https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 Prerequisites OS: Kali Linux has most packages pre-installed. NetExec NXC ...

[R1] Tenable Identity Exposure Versions 3.93.6 and 3.77.18 Fix Multiple Vulnerabilities

R1 Tenable Identity Exposure Versions 3.93.6 and 3.77.18 Fix Multiple Vulnerabilities Arnie Cabral Fri, 10/30/2026 - 00:00 Several vulnerabilities have been identified, reported to Tenable and resolved. Please see the full list of resolved issues below. A command injection vulnerability in the...

Tenable Identity Exposure < 3.77.18 (LTS) / 3.93.6 Multiple Vulnerabilities (TNS-2026-34)

The version of Tenable Identity Exposure running on the remote host is prior to 3.77.18 LTS, or 3.78.x prior to 3.93.6. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-34: - A command injection vulnerability in the Active Directory Events Listener of Tenable...

CVE-2026-118689 OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader that allows unauthenticated attackers to stall connections by sending payloadlength values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinite...

CVE-2026-118689

OvenMediaEngine versions through 0.21.0 are vulnerable to a Denial of Service (DoS) attack due to a flaw in the OvtPacket::LoadHeader() function. Unauthenticated attackers can exploit this by sending crafted OVT packets with payload_length values exceeding 32750 . This allows the attacker to stal...

CVE-2026-118689 OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader that allows unauthenticated attackers to stall connections by sending payloadlength values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinite...

GHSA-C8M5-C952-6CM4 vulnerabilities

Vulnerabilities for packages: kcl-lib, samply, komodo, symbolicator, ascan, cargo-audit, sccache, zellij, symbolicator-fips, sentry-relay-fips, garage, wasmcloud, cloud-hypervisor, cleave, ztunnel, efs-utils, zizmor, wadm, kdash, qdrant, buck2, lychee, vector, sentry-relay, ntpd-rs...

GHSA-W44R-93J7-QV28 vulnerabilities

Vulnerabilities for packages: kcl-lib, samply, komodo, symbolicator, ascan, cargo-audit, sccache, zellij, symbolicator-fips, sentry-relay-fips, garage, wasmcloud, cloud-hypervisor, cleave, ztunnel, efs-utils, zizmor, wadm, kdash, qdrant, buck2, lychee, vector, sentry-relay, ntpd-rs...