GHSA-5JJV-X4FQ-QJWP Possible timing attack in derivation_endpoint

Impact When using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. Patches The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare. Users using the...

Possible timing attack in derivation_endpoint

Impact When using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. Patches The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare. Users using the...

Possible timing attack in derivation_endpoint

Impact When using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. Patches The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare. Users using the...

UPDATE: Infection Monkey 1.9.0

Infection Monkey 1.9.0, the open source breach and attack simulation tool was released a few hours ago - just in time for BlackHat/DefCon 2020. My first post about this tool can be found in a post titled the List of Adversary Emulation Tools. Updates include an expanded list of MITRE ATT&CK...

UPDATE: Infection Monkey 1.8.2

Infection Monkey 1.8.2, the open source breach and attack simulation tool was released a yesterday. My first post about this tool can be found in a post titled the List of Adversary Emulation Tools. To keep it simple from the last update, this is a small maintenance release. It includes some bug...

UPDATE: Infection Monkey 1.8.0

Infection Monkey 1.8.0 was released a while ago. My first post about this tool can be found in a post titled the List of Adversary Emulation Tools. This is a big, exciting release, which enhances the Monkey’s capabilities. The Monkey now maps its actions to the MITRE ATT knowledge base and as...

Malicious Package

Overview spider-monkey is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using spider-monkey...

Cross site scripting vulnerability in ActionView

There is a possible cross site scripting XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. Impact There is a possible XSS vulnerability in the j and escapejavascript methods in ActionView. These...

GHSA-65CV-R6X7-79HV Cross site scripting vulnerability in ActionView

There is a possible cross site scripting XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. Impact There is a possible XSS vulnerability in the j and escapejavascript methods in ActionView. These...

UPDATE: Infection Monkey 1.7.0

Infection Monkey 1.7.0 was released a while ago. My first post about this tool can be found in a post titled the List of Adversary Emulation Tools. This is a big, exciting release, with a ton of new features and improvements and as always, this post will list down the changes for this version. Wh...

CVE-2013-2159

Monkey HTTP Daemon: broken user name authentication...

CVE-2013-2183

Monkey HTTP Daemon has local security bypass...

CVE-2013-2183

Monkey HTTP Daemon has local security bypass...

Security feature bypass

Monkey HTTP Daemon has local security bypass...

CVE-2013-2159

Monkey HTTP Daemon: broken user name authentication...

CVE-2013-2183

Technical details about CVE-2013-2183 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2013-2183

Monkey HTTP Daemon has local security bypass...

CVE-2013-2159

CVE-2013-2159 affects Monkey HTTP Daemon with a broken user name authentication mechanism. The NVD notes a CVSSv2 base score of 7.5 (HIGH) and CVSSv3.1 base score of 9.8 (CRITICAL), indicating high impact on confidentiality, integrity, and availability. Connected records reaffirm the same issue, ...

CVE-2013-2159

Monkey HTTP Daemon: broken user name authentication...

UPDATE: Infection Monkey 1.6.3

PenTestIT RSS Feed Some days ago, Infection Monkey 1.6.3 was released. The first post about this tool can be found in a post titled the List of Adversary Emulation Tools. This is a small bugfix release, mostly around integration and packaging. It contains two user facing changes as well. What is...