A double-decoding flaw exposed REDCap's Data Import controller to public survey users. A client-controlled PHP stream then turned CSV BOM cleanup into a Blade cache overwrite and unauthenticated RCE.
A stack overflow in FatPipe's privileged authentication helper looked like the hard path to root. Tracing its web reachability exposed a second flaw in the middle: unauthenticated command injection in xtremed.
CVSS scoring disputes often come down to mixing intrinsic vulnerability severity with deployment assumptions, exploit-development effort, remediation pressure, and bounty economics. This guide explains how to keep those factors in the right metrics.
I remember watching Simon Scannell's REcon 2023 talk, You Have Become the Very Thing You Swore to Destroy, and being deeply impressed by how he turned ClamAV's own detection logic into an oracle for exploiting a service with no direct output channel. I remember hoping that, someday, I might have the opportunity to [...]
Unless you've been living under a rock, you're probably aware frontier large language models (LLMs) have been keenly focused on automating software development, vulnerability discovery, and most recently exploit development. The most publicized instance of this was Anthropic's marketing campaign around the release of Mythos. What better way to drum up business than [...]
N-Able Windows Software Probe Remote Code Execution Recently I was performing a penetration test using Reverge when an interesting service caught my attention. The banner reported “ms .net remoting services” listening on port 10004. For those unfamiliar, .NET Remoting is an older Microsoft framework that allows applications to expose [...]
Introducing the Reverge AI Assistant This month, we rolled out one of reverge's most anticipated features: an integrated AI assistant that transforms how reverge users can interact with the platform. While AI tools have become commonplace in many industries, we trained reverge's AI assistant specifically for the unique challenges of attack surface [...]
What are reverge collectors? Collectors serve as the distributed job engine for the reverge platform. Operating as a remote collection agent, it receives scanning tasks from the reverge server and executes various tools. This client-server architecture enables scalable reconnaissance operations across multiple environments while maintaining centralized coordination and data aggregation. [...]
From POC to RCE with reverge Last month, Securifera publicly launched our attack surface management tool, reverge, on the AWS Marketplace. While we’re still planning to publish blog posts and videos to guide users through setup and usage, we wanted to give an example of what reverge can do by demonstrating how [...]
This article is in no way affiliated, sponsored, or endorsed with/by Okta, Inc. All graphics are being displayed under fair use for the purposes of this article. Poppin shells with Okta Verify on Windows These days I rarely have an opportunity to do bug hunting. Fortunately, over the holiday break, I [...]
