Malicious Package

Overview All versions of owl-orchard-apple-sunshine contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored ...

Unix Command Shell, Reverse TCP (via jjs)

Connect back and create a command shell via jjs This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 863 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

Reverse Tabnabbing

showdown is vulnerable to reverse tabnabbing. The vulnerability exists due to a misconfiguration whereby the setting of rel="noopener noreferrer" is not set when openLinksInNewWindow is on...

Unspecified Vulnerability in JetBrains TeamCity

TeamCity is a Java-based build management and continuous integration server from JetBrains. A security vulnerability exists in versions of JetBrains TeamCity prior to 2019.1.4. An attacker can exploit the vulnerability to conduct a reverse tag phishing attack...

Reverse Tabnabbing

Overview Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks. Recommendation Upgrade to version 1.9...

CVE-2019-18365

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages...

CVE-2019-18365

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages...

Design/Logic Flaw

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages...

CVE-2019-18365

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages...

CVE-2019-18365

CVE-2019-18365 affects JetBrains TeamCity prior to 2019.1.4. The connected documents describe a reverse tabnabbing issue on several pages, enabling tabnabbing/phishing-style risk when users follow links. Public details confirm the vulnerability description but do not disclose exploit code or prac...

CVE-2018-18931

An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services directory, an attacker who has gained access to the system can elevate their privileges from a restricted account to full SYSTEM by replacing the...

AutoSploit v4.0 - Automated Mass Exploiter

As the name might suggest AutoSploit attempts to automate the exploitation of remote hosts. Targets can be collected automatically through Shodan, Censys or Zoomeye. But options to add your custom targets and host lists have been included as well. The available Metasploit modules have been select...

UPDATE: AutoSploit 4.0

PenTestIT RSS Feed AutoSploit 4.0 was released a month ago. I wrote about AutoSploit in a post titled AutoSploit = Shodan/Censys/Zoomeye + Metasploit and it’s subsequent update to AutoSploit 3.0. This version primarily adds support for running nmap scans within the same terminal. What is...

CVE-2019-4036

IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM X-Force ID: 156159...

CVE-2019-4036

CVE-2019-4036 affects IBM Security Access Manager Appliance. The available documents show unauthenticated remote denial-of-service against the reverse proxy, commonly associated with Slow HTTP/Slowloris abuse. Affected product: IBM Security Access Manager Appliance (ISAM Appliance); impact: denia...

New Cache Poisoning Attack Lets Attackers Target CDN Protected Sites

A team of German cybersecurity researchers has discovered a new cache poisoning attack against web caching systems that could be used by an attacker to force a targeted website into delivering error pages to most of its visitors instead of legitimate content or resources. The issue could affect...

New Cache Poisoning Attack Lets Attackers Target CDN Protected Sites

A team of German cybersecurity researchers has discovered a new cache poisoning attack against web caching systems that could be used by an attacker to force a targeted website into delivering error pages to most of its visitors instead of legitimate content or resources. The issue could affect...

Fedora Update for radare2 FEDORA-2019-65c33bdc2a

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: radare2-3.9.0-3.fc29.1

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

Restaurant Management System 1.0 Shell Upload

Exploit Title: Restaurant Management System 1.0 - Remote Code Execution Date: 2019-10-16 Exploit Author: Ibad Shah Vendor Homepage: https://www.sourcecodester.com/users/lewa Software Link: https://www.sourcecodester.com/php/11815/restaurant-management-system.html Version: N/A Tested on: Apache...