Hans-Martin Münch

Generex RCCMDTray Remote OS Command Execution

New security advisory: Generex RCCMDTray Remote OS Command Execution. mogwailabs.de/en/advisorie...

AppSec Ezine - 595th pathonproject.com/zb/?0d340b7b... #AppSec #Security

Let Me Cook You a Vulnerability: Exploiting the Thermomix TM5 Hardware Analysis The Thermomix TM5 is a multifunctional kitchen appliance composed of two key electronic boards: the power board, which handles the motor and heating functions, and the main board, w

Ever thought your kitchen appliance could harbor a persistent threat?
We reverse-engineered the Thermomix TM5 and uncovered vulnerabilities allowing arbitrary code execution, persistence, and secure boot bypass.
Discover our step-by-step breakdown!
www.synacktiv.com/en/publicati...

AppSec Ezine - 594th pathonproject.com/zb/?80aec227... #AppSec #Security

fwd:cloudsec fwd:cloudsec is a non-profit, conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

fwd:cloudsec2025 videos are up

www.youtube.com/@fwdcloudsec...

Beacon Object Files – Five Years On… When I was active in the red teaming space, one of my stated goals was to act on problems with solutions that would have utility 5-10 years from the time of their release. This long-term thinking w…

Beacon Object Files... Five Years On

aff-wg.org/2025/06/26/b...

I released BOFs with Cobalt Strike 4.1 five years ago. This is some history on the feature and what led to it. My thinking at the time. A few thoughts on current discourse.

4D Unauthenticated File Disclosure

We just added a new vulnerability to our "bug parade" page. If you are using 4D based applications, please ensure that you are on the latest patch level to avoid potential security risks.

mogwailabs.de/en/advisorie...

A quick-and-dirty late night blog post on discovering an nday variant in Zyxel NWA50AX Pro devices

frycos.github.io/vulns4free/2...

AppSec Ezine - 591st edition #AppSec #Security

pathonproject.com/zb/?f5f861f4...

AppSec Ezine - 589th edition #AppSec #Security

pathonproject.com/zb/?33afd768...

AppSec Ezine - 588th edition #AppSec #Security

pathonproject.com/zb/?cb31cee2...

OffensiveCon25 - Cedric Halbronn and Jael Koh YouTube video by OffensiveCon

OffensiveCon 25 videos are out. Thank you @offensivecon www.youtube.com/watch?v=goEb...

We had several customers leaking secrets through Postman, for reference: For reference: www.leeholmes.com/security-ris...

AppSec Ezine - 587th pathonproject.com/zb/?354c6db3... #AppSec #Security

Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-...

AppSec Ezine - 586th edition #AppSec #Security

pathonproject.com/zb/?65eb4ad1...

HTML to PDF Renderer: A tale of local file access and shellcode execution In a recent engagement, we found an HTML to PDF converter API endpoint that allowed us to list local directories and files on a remote server. One of the PDF files we created, revealed that the conver...

From iframes and file reads to full RCE. 🔥

We found an HTML-to-PDF API allowing file reads and SSRF - then chained it into remote code execution via a Chromium 62 WebView exploit.

👉 Read the full write-up here: neodyme.io/en/blog/html...

AppSec Ezine Edition #584
pathonproject.com/zb/?39a1a5b0...

A few quick notes on the Erlang OTP SSHd RCE (CVE-2025-32433) [1/3]

1. Cisco confirmed that their ConfD and NSO products are affected. The ConfD patch is planned for May. These often run on ports 830, 2022, and 2024 versus 22.

sec.cloudapps.cisco.com/security/cen...

The profile you need to create has been documented by the PortSwigger's support team 🔍

Scroll down to the end of the following thread and simply copy the provided config to /etc/apparmor.d/burpbrowser 💪

forum.portswigger.net/thread/burp-...

CVE-2025-30065 | AttackerKB Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to u…

Good analysis of CVE-2025-30065 (Java Deserialization Vulnerability in Apache Parket). I would that (depending on the Java version) it possible to use a gadget that causes an outgoing JNDI call. attackerkb.com/topics/jAhVR...

unauth-rce++ 😊

Our crew members @mwulftange.bsky.social & @frycos.bsky.social discovered & responsibly disclosed several new RCE gadgets that bypass #Veeam 's blacklist for CVE-2024-40711 & CVE-2025-23120 + further entry points after @sinsinology.bsky.social & @chudypb.bsky.social 's blog. Replace BinaryFormatter!

Also an ideal candidate for beg-bounty hunters 🤷‍♂️

Millions Of Public Certificates Are Reusing Old Private Keys - Dylan Ayrey, Joseph Leon YouTube video by OWASP Foundation

Private Key reuse for requesting https certificates is the new "outdated JavaScript libraries" for penetration testers.

- Large number of services affected
- Easy to find / verify
- Hard to actually exploit

Still nice research from the Truffle Security Team.

www.youtube.com/watch?v=gyyt...

GitHub - jduck/bs25-slides: Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25 Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25 - jduck/bs25-slides

Happy to share my slides from BOOTSTRAP25. Unfortunately the bug discussed is still not patched in Linux 6.14.0 despite it being reported explicitly. Slides are in markdown but there's a PDF in "releases" too github.com/jduck/bs25-s...

Today, Wiz (Woogle?) released an advisory detailing an attack chain they’ve dubbed IngressNightmare, which, if left exposed and unpatched, can be exploited to achieve remote code execution by unauthenticated attackers. Read more at www.runzero.com/blog/ingress...

Look Mom, smalidea (github.com/JesusFreke/s...) has new features: 1. Call-Hierarchy

Security Code Audit of Mullvad VPN · Zoom · Luma Join us for a presentation and meetup with Markus Vervier and Eric Sesterhenn of X41 D-Sec GmbH around their company's audit of Mullvad VPN. Markus Vervier is…

Our next meetup is a presentation from our friends at X41 D-Sec GmbH. Join us next Wednesday, March 26th, at 14:00 CDT for a presentation and discussion with Markus Vervier and Eric Sesterhenn on their audit of @mullvad.bsky.social. We can't wait for this one! RSVP at lu.ma/wreregye

unauth-rce++ 😊