Arbitrary File Read | writeups.xyz

Title	Vulnerabilities	Programs	Authors
Multiple vulnerabilities in H2O ≤ 3.32.1.3	Insecure Deserialization RCE Arbitrary File Read Security Code Review	H2O	Clément Amic (@Loadlow) Lena David
Remote Command Execution in a Bank Server	RCE Arbitrary File Read Unrestricted File Upload	Undisclosed	Bipin Jitiya (@Win3zz)
Checkmk: Remote Code Execution by Chaining Multiple Bugs (1/3)	RCE Code Injection SSRF Line Feed Injection Arbitrary File Read Authentication Bypass Security Code Review	Checkmk	Stefan Schiller (@Scryh_)
Visual Studio Code Jupyter Notebook RCE	RCE XSS Arbitrary File Read Electron	Microsoft	Luca Carettoni (@Lucacarettoni)
GL.iNET GL-MT300N-V2 Router Vulnerabilities and Hardware Teardown	OS Command Injection Arbitrary File Read Information Disclosure Account Takeover Stored XSS Lack of Rate Limiting Weak Credentials Password Policy Bypass	GL.iNet	Olivier Laflamme (@Olivier_boschko)
Second Order XXE Exploitation	XXE Arbitrary File Read	Undisclosed	Kuldeep Pandya (@Kuldeepdotexe)
Exploiting Distroless Images	Command Injection Arbitrary File Read Arbitrary File Write Container Escape	Google	Daniel Teixeira (@TheRedOperator)
Chaining Telegram bugs to steal session-related files.	Arbitrary File Read Android	Telegram	Sayed Abdelhafiz (@DPhoeniixx)
From Shodan to RCE: That one time I hacked a Fortune 500 company.	Missing Authentication Arbitrary File Read RCE Exposed Jenkins Instance	Undisclosed	Vimanari_ (@Vimanari_)
Finding bugs to trigger Unauthenticated Command Injection in a NETGEAR router (PSV-2022–0044)	XSS Arbitrary File Read Authentication Bypass OS Command Injection RCE	Netgear	Stypr (@Stereotype32)
How I hacked Google to read files from their servers for free!	Arbitrary File Read	Google	Harish SG (@CoderHarish)
NodeBB 1.18.4 - Remote Code Execution With One Shot	RCE XSS Authentication Bypass Arbitrary File Read	NodeBB	Sonar (@SonarSource)
VMware vCenter earlier versions (7.0.2.00100) has unauthorized arbitrary file read + ssrf + xss vulnerability	LFI SSRF XSS Arbitrary File Read	VMware	Khoa Dinh (@_L0gg)
Write Up – Apple N/A: PII Information, Full Contact List, Main Phone No. And Main Icloud Email Extracted; Bug Patched: Arbitrary Local File Read Via Zip File And Symlinks On Ios Files App.	Arbitrary File Read	Apple	Omar Espino (@Omespino)
Riding The Inforail To Exploit Ivanti Avalanche Part 2	RCE Insecure Deserialization Path Traversal Authentication Bypass Unrestricted File Upload Arbitrary File Write Arbitrary File Read	Ivanti	Piotr Bazydło (@Chudypb)
Two weeks of securing Samsung devices: Part 2	Arbitrary File Write Arbitrary File Read Vulnerable Android Content Provider Android	Samsung	Oversecured (@OversecuredInc)
OVE-20210809-0001 Visual Studio Code .ipynb Jupyter Notebook XSS (Arbitrary File Read)	XSS Arbitrary File Read	Microsoft	Justin Steven (@Justinsteven)
Android: Exploring vulnerabilities in WebResourceResponse	Arbitrary File Read Android	Amazon	Oversecured (@OversecuredInc)
GitLab Arbitrary File Read & Write through Kroki - CVE-2021-22203	Arbitrary File Read	Undisclosed	Anh Duc Nguyen (@Ledz1996)
Brave — Stealing your cookies remotely	Arbitrary File Read	Brave Software	Pedro Oliveira (@Kanytu)
Facebook Messenger Desktop App Arbitrary File Read	Arbitrary File Read	Meta / Facebook	Renwa (@RenwaX23)
OpenEMR 5.0.1.3 Arbitrary File Actions	Arbitrary File Write Arbitrary File Read Security Code Review	OpenEMR	Josh Fam (@Pullerze)
Firefox: How a website could steal all your cookies	Arbitrary File Read	Mozilla	Pedro Oliveira (@Kanytu)
CVE-2019-18426 - WhatsApp Vulnerabilities Disclosure - Open Redirect + CSP Bypass + Persistent XSS + FS read permissions + potential for RCE	RCE Stored XSS CSP Bypass Arbitrary File Read Open Redirect Security Code Review	Meta / Facebook (WhatsApp)	Gal Weizman (@WeizmanGal)

Page 2 of 2