website

RCE in Strix Agent: A practical guide to getting prompt injections with impact Prompt injection is still a topic that raises many opinions and different understandings of impact and how to exploit it.

Introduction Recently we dived into Fortinet EMS for vulnerability research, as we like to use our spare time to hone skills and keep customers safe by addressing zero-days.

Introduction AI, vibecoding.

Summary A spoofing vulnerability was discovered in the Media Component of Google Chrome and all Chromium-based browsers.

Introduction This post details the process of going from absolutely nothing to achieving a fully unauthenticated remote code execution exploit as root in a Mitel IP phone.

Security vulnerability in Mitel product line (Mitel Advisory ID 24-0010) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0010.

Security vulnerability in Mitel product line (Mitel Advisory ID 24-0009) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0009.

Security vulnerability in Mitel product line (Mitel Advisory ID 24-0008) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0008.

Security vulnerability in Mitel product line (Mitel Advisory ID 24-0007) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0007.

Security vulnerability in Mitel product line (Mitel Advisory ID 24-0006) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0006.

Introduction This post illustrates the importance of manual code review when doing application security.

Table of Contents Introduction Doscember 1 Doscember 2a Introduction During the course of the last two weeks danish NC3 has held their annual CTF competition.

Table of Contents Introduction Setting up our development environment Buiding the exploit for CVE-2023-32781 Using CmdStager to run Meterpreter Submitting the module to metasploits public repository Introduction People regularly use metasploit for utilizi…

Introduction This blog post uncovers a serious bug in WithSecure Elements, detailing how a seemingly simple issue had a major impact.

Introduction This post details the process of exploiting CVE-2023-32782 in PRTG to gain remote code execution.

Remote code execution in Dicom Query sensor as SYSTEM

Remote code execution in HL7 sensor as SYSTEM

CSRF allowing the leakage of cleartext windows credentials over the network.

Utilize regex feature for leaking sensitive configuration files

Path traversal in SQL sensor

Path traversal in WMI sensor

A path traversal vulnerability was discovered in the HL7 sensor of PRTG allowing for exfiltatration of system files

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability allows a remote attacker to bypass authentication process.

Unauthed memory corruption in the fsicapd component leads to DoS

Unauthenticated arbitrary filewrite as SYSTEM

Multiple Cross-Site (XSS) Scripting vulnerabilities

Unauthed memory corruption in the fsicapd component leads to DoS

XSS which leads to a leaked private key allowing wallet control

Global CSRF bypass due to RFC incompliance in HTTP header

Heap Based buffer overflow leads to Remote Code Execution

Remote Code Execution in F-secure Server Security

Cerberus FTP login XSS leads to RCE

Fortinet IPC permission leads to local privilege escalation as SYSTEM