penelope

Penelope is a modern shell handler for penetration testers and CTF players. It provides a more capable alternative to basic netcat listeners, adding automatic PTY upgrades, session management, logging, file transfers and helper modules. Table of Contents 📥 Installation ⚙️ Features 🖥️ Session...

penelope

Penelope è un moderno gestore di shell per penetration tester e giocatori di CTF. Offre un'alternativa più potente ai semplici listener netcat, aggiungendo aggiornamenti automatici PTY, gestione delle sessioni, logging, trasferimento di file e moduli helper. Sommario 📥 Installazione ⚙️ Funzionalit...

CVE-2026-19245

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-50558

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

Directory Traversal

Overview penelope-shell-handler is a Post-exploitation shell handler for authorized security testing Affected versions of this package are vulnerable to Directory Traversal in the download process when extracting tar archives from a remote session without validating archive member paths. An...

CVE-2026-50558

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

PT-2026-65830

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocal download folder on tar archives returned by remote sessions without validating member paths, allowing a malicious ...

CVE-2026-10650

A flaw was found in libwebsockets, specifically within its SSH Protocol Handler component. A remote attacker can exploit this vulnerability by manipulating the 'msglen' argument in the 'lwssshparseplaintext' function. This manipulation can lead to excessive resource consumption, resulting in a...

CVE-2025-13809

A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection...

EUVD-2025-199957

A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection...

(0Day) Microsoft Windows PowerShell Shell Handler Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the shell handle...

CVE-2020-6799

CVE-2020-6799 is a vulnerability in Mozilla Firefox where command line arguments could be injected during Firefox invocation when Firefox is the default handler for non-default filetypes and a downloaded file is opened by a third‑party application that does not sanitize URL data. The issue could ...

CVE-2019-9794

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the...

CVE-2019-9794

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the...

Microsoft Windows Shell Handler Privilege Escalation Vulnerability (2962488)

This host is missing an important security update according to Microsoft Bulletin MS14-027. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS14-027: Vulnerability in Windows Shell Handler Could Allow Elevation of Privilege (2962488)

A privilege escalation vulnerability exists on the remote Windows host due to improper handling of file associations. A local attacker could exploit this vulnerability to execute arbitrary code on the remote host under the privileges of the Local System account. C Tenable Network Security, Inc...

Microsoft Windows Shell Handler Could Allow Remote Code Execution Vulnerability (975713)

This host is missing a critical security update according to Microsoft Bulletin MS10-007. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Security Bulletin MS10-007 - Critical Vulnerability in Windows Shell Handler Could Allow Remote Code Execution (975713)

Microsoft Security Bulletin MS10-007 - Critical Vulnerability in Windows Shell Handler Could Allow Remote Code Execution 975713 Published: February 09, 2010 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Microsoft Windows 200...

Microsoft Windows Shell Handler Could Allow Remote Code Execution Vulnerability (975713)

This host is missing a critical security update according to Microsoft Bulletin MS10-007. OpenVAS Vulnerability Test $Id: secpodms10-007.nasl 5361 2017-02-20 11:57:13Z cfi $ Microsoft Windows Shell Handler Could Allow Remote Code Execution Vulnerability 975713 Authors: Veerendra GG Copyright:...

MS10-007: Vulnerability in Windows Shell Handler Could Allow Remote Code Execution (975713)

The ShellExecute API function on the remote host fails to properly validate URLs, which could result in arbitrary code execution. A remote attacker could exploit this by tricking a user into making an application e.g. web browser pass specially crafted data to the vulnerable function, resulting i...