Arbitrary File Read | writeups.xyz

Title	Vulnerabilities	Programs	Authors
Analysis of CVE-2024-43044 — From file read to RCE in Jenkins through agents	RCE Arbitrary File Read	Jenkins	Gabriel Quadros (@Gqsilva) Ricardo Silva (@Rick2600)
3CX Phone System Local Privilege Escalation Vulnerability	Local Privilege Escalation Arbitrary File Read	3CX	Adam Crosser
Studying 0days: How we hacked Anki, the world's most popular flashcard app	RCE Components With Known Vulnerabilities Arbitrary File Read Arbitrary File Write XSS Security Code Review	Anki	Jacob Autumn Skerritt
Firmware Security: Alcatel-Lucent ALE-DeskPhone	VoIP Hacking Hardware Hacking Reverse Engineering Arbitrary File Read TOCTOU Local Privilege Escalation	Alcatel-Lucent	Moritz Abrell (@Moritz_abrell)
CVE-2024-29511 – Abusing Ghostscript’s OCR device	Arbitrary File Read Arbitrary File Write Security Code Review	Ghostscript	Thomas Rinsma (@Thomasrinsma)
From Limited file read to full access on Jenkins (CVE-2024-23897)	RCE Arbitrary File Read	Undisclosed	Ahmed Sherif
Exploiting Steam: Usual and Unusual Ways in the CEF Framework	Browser Hacking Thick Client RCE OS Command Injection Arbitrary File Read Arbitrary File Creation Components With Known Vulnerabilities	Valve (Steam) Google (Chromium)	DARKNAVY (@DarkNavyOrg)
Dangerous Import: SourceForge Patches Critical Code Vulnerability	Arbitrary File Read RCE Security Code Review	SourceForge Apache Allura	Stefan Schiller (@Scryh_)
Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins (CVE-2024-23897 & CVE-2024-23898)	Cross-Site WebSocket Hijacking (CSWH) Data Leak Arbitrary File Read Security Code Review	Jenkins	Yaniv Nizry (@YNizry)
Unauthenticated RCE in Adobe Coldfusion – CVE-2023-26360	RCE Insecure Deserialization Arbitrary File Read Patch Diffing Security Code Review	Adobe (ColdFusion)	SecureLayer7 (@SecureLayer7)
Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise	Account Takeover Information Disclosure RCE Unrestricted File Upload Stored XSS Arbitrary File Read Local Privilege Escalation Path Traversal DoS IDOR Hardcoded Credentials	PandoraFMS	Oliver Brooks
Silverpeas App: Multiple CVEs leading to File Read on Server	Stored XSS Arbitrary File Read	Silverpeas	Tyler Ramsbey (@Tyler_Ramsbey)
Multiple Vulnerabilities In Extreme Networks ExtremeXOS	Arbitrary File Read Arbitrary File Write SSRF RCE Privilege Escalation Local Privilege Escalation CSRF Security Code Review	Extreme Networks	David Yesland (@Daveysec)
Apache Superset Part II: RCE, Credential Harvesting and More	RCE Insecure Deserialization URL Validation Bypass Broken Authorization Arbitrary File Read Insufficiently Protected Credentials Default Flask Secret Key Hardcoded Credentials	Apache Superset	Naveen Sunkavally
Leaking File Contents with a Blind File Oracle in Flarum	PHP Filter Chain Arbitrary File Read LFI Security Code Review	Flarum	Adam Kues (@Hash_kitten)
[REL] A Journey Into Hacking Google Search Appliance	RCE Line Feed Injection Path Traversal Arbitrary File Read Information Disclosure Security Code Review	Google	DEVCORE (@D3vc0r3)
Partial File Read in phpList <= 3.6.12 (CVE-2023-35834)	Arbitrary File Read PHP Filter Chain Security Code Review	PhpList	Vincent Herbulot Rémi Matasse (@_Remsio_)
Kramer VIA GO² – Multiple issues	RCE SQL Injection Arbitrary File Upload Arbitrary File Read	Kramer	Jim Rush (@JimSRush) Tomais Williamson (@Softpoison_)
Pretalx Vulnerabilities: How to get accepted at every conference	Arbitrary File Read Arbitrary File Write RCE Security Code Review	Pretalx	Stefan Schiller (@Scryh_)
PHP Filter Chains: File Read From Error-based Oracle	Arbitrary File Read LFI PHP Filter Chain	Undisclosed	Rémi Matasse (@_Remsio_)
Attacking .NET Web Services	Security Code Review Arbitrary File Read Arbitrary File Write SSRF	Siemens	B0yd (@Rwincey)
Multiple vulnerabilities in Dell Unisphere for PowerMax vApp, VASA Provider vApp and Solutions Enabler vApp CVE-2022-45103 / CVE-2022-45104	Parameter Injection Arbitrary File Read RCE	Dell	Antoine Carrincazeaux
ImageMagick: The hidden vulnerability behind your online images	Application-Level DoS Arbitrary File Read Security Code Review	ImageMagick	Bryan Gonzalez
OpenEMR - Remote Code Execution in your Healthcare System	RCE XSS LFI Arbitrary File Read Security Code Review	OpenEMR	Dennis Brinkrolf (@DBrinkrolf)
Multiple Vulnerabilities in Proxmox VE & Proxmox Mail Gateway	XSS CRLF Injection SSRF LFI Local Privilege Escalation Arbitrary File Read	Proxmox	JianTao Li (@Cursered)

Page 1 of 2