RCE | writeups.xyz

Title	Vulnerabilities	Programs	Authors
The ART of Chaining Vulnerabilities	Android WAF Bypass Bruteforce Hardcoded Credentials RCE	Undisclosed	Ahmad Halabi (@Ahmad_Halabi_)
Hacking Cloudflare Pages part 2	Path Traversal RCE Arbitrary Code Execution	Cloudflare	Ec0
DoubleTrouble	RCE Insecure Deserialization Security Code Review	Inductive Automation Ignition	Rocco Calvi (@TecR0c) Steven Seeley (@Steventseeley)
SSH ProxyCommand == unexpected code execution (CVE-2023-51385)	OS Command Injection RCE	OpenSSH	Vin01
Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 1	RCE	Microsoft (Outlook)	Ben Barnea (@Nachoskrnl)
CVE-2023-22524: RCE Vulnerability in Atlassian Companion for macOS	RCE MacOS Websockets Thick Client Security Code Review	Atlassian	Ron Masas (@RonMasas)
npm search RCE? - Escape Sequence Injection	RCE Escape Sequence Injection	Radare2 GitHub NPM CLI	Solid-Snail
Remote Code execution at ws1.aholdusa.com — Compromising logins of Ahold Delhaize USA employees for >3.5 years (or even 18 years?)	RCE Reflected XSS SSTI	Ahold Delhaize	Jonathan Bouman (@JonathanBouman)
Technical Advisory – Multiple Vulnerabilities in Nagios XI	RCE Missing Authentication OS Command Injection Local Privilege Escalation Stored XSS Plaintext Storage of a Password Weak Credentials Privilege Escalation Post-Exploitation	Nagios	Oliver Brooks
Remote code execution and elevation of local privileges in Mitel Unify OpenStage and OpenScape VoIP phones	VoIP RCE Missing Authentication MiTM Local Privilege Escalation	Mitel (Atos Unify)	Pentagrid (@Pentagridsec)
3 Symfony (RCE): A Peek Behind the Curtain	RCE	Undisclosed	Omar ElSayed (@Bxrowski0x)
SonicWall WXA – Authentication Bypass and Remote Code Execution Vulnerability	Authentication Bypass Hardcoded Credentials RCE Argument Injection Security Code Review	SonicWall	Adam Crosser
Argument injection vulnerability in multiple Atos Unify OpenScape products	Argument Injection RCE Authentication Bypass Security Code Review	Mitel (Atos Unify)	Armin Weihbold (@Koyaan5)
Multiple Vulnerabilities In Extreme Networks ExtremeXOS	Arbitrary File Read Arbitrary File Write SSRF RCE Privilege Escalation Local Privilege Escalation CSRF Security Code Review	Extreme Networks	David Yesland (@Daveysec)
Achieving Remote Code Execution in Steam: a journey into the Remote Play protocol	RCE Reverse Engineering Fuzzing Path Traversal Memory Corruption Heap Overflow Format String Vulnerability	Valve	Valentino Ricotta
It's not a Feature, It's a Vulnerability	RCE OS Command Injection	Microsoft	Solid-Snail
Owncloud: details about CVE-2023-49103 and CVE-2023-49105	RCE Privilege Escalation Authentication Bypass Information Disclosure Security Code Review	OwnCloud	Charles Fol (@Cfreal_)
CVE-2023-37927 & CVE-2023-37928 - Multiple post-auth blind OS command and Python code injection vulnerabilities in Zyxel’s NAS326 devices	Code Injection OS Command Injection RCE Security Code Review	Zyxel	Gábor Selján (@GaborSeljan)
CVE-2023-4473 & CVE-2023-4474 - Authentication bypass and multiple blind OS command injection vulnerabilities in Zyxel’s NAS326 devices	Authentication Bypass OS Command Injection RCE Security Code Review	Zyxel	Gábor Selján (@GaborSeljan)
Gadgets chain in Laravel	Insecure Deserialization RCE Security Code Review	Undisclosed	Maxime Rinaudo (@MaxRio13)
Securing our home labs: Home Assistant code review	Insecure Deserialization CSRF RCE Code Injection Android IOS Security Code Review	Home Assistant	Alvaro Muñoz (@Pwntester)
Gadgets chain in WordPress	Insecure Deserialization RCE Security Code Review	Undisclosed	Maxime Rinaudo (@MaxRio13)
Ray, Versions 2.6.3, 2.8.0	Missing Authentication SSRF RCE	Anyscale (Ray)	Berenice Flores Garcia
Visual Studio Code Security: Finding New Vulnerabilities in the NPM Integration (3/3)	RCE Argument Injection Security Code Review	Microsoft (VS Code)	Thomas Chauchefoin (@Swapgs) Paul Gerste
Magento Template Engine, A Story Of CVE-2022-24086	SSTI RCE Security Code Review	Magento	Antoine Gicquel (@Blueshhit)

Page 6 of 35