Security Code Review | writeups.xyz

Title	Vulnerabilities	Programs	Authors
Getting code execution on Veeam through CVE-2023-27532	RCE Insecure Deserialization Security Code Review	Veeam	Alain Mowat (@Plopz0r)
Spip Preauth RCE 2024: Part 2, A Big Upload	RCE File Upload Security Code Review	SPIP	Laluka (@TheLaluka)
Basic HTTP Authentication Risk: Uncovering pyspider Vulnerabilities	Reflected XSS CSRF Security Code Review	Pyspider	Yaniv Nizry (@YNizry)
IIS welcome page to source code review to LFI!	LFI Blind SSRF Security Code Review	Undisclosed	Omar Ahmed (@Spaceboy2O)
Breaking Down Barriers: Exploiting Pre-Auth SQL Injection In WhatsUp Gold - CVE-2024-6670	SQL Injection Reverse Engineering Security Code Review	Progress (WhatsUp Gold)	Sina Kheirkhah (@SinSinology)
Back To School - Exploiting A Remote Code Execution Vulnerability In Moodle	RCE Security Code Review	Moodle	RedTeam Pentesting (@RedTeamPT)
WordPress GiveWP POP to RCE (CVE-2024-5932)	RCE PHP Pop Chain PHP Object Injection Security Code Review	Wordfence	Julien Ahrens (@MrTuxracer)
NTLM Credential Theft in Python Windows Applications	SSRF NTLMv2 Hash Disclosure NTLM Security Code Review	Python Hugging Face (Gradio) Werkzeug Jupyter Snowflake (Streamlit)	Naveen Sunkavally
Traccar 5 Remote Code Execution Vulnerabilities	RCE Unrestricted File Upload Path Traversal Security Code Review	Traccar	Naveen Sunkavally
WPML Multilingual CMS Authenticated Contributor+ Remote Code Execution (RCE) via Twig Server-Side Template Injection (SSTI)	SSTI RCE Security Code Review	Wordfence	Matthew Rollings (@Stealthcopter)
$4,998 Bounty Awarded and 100,000 WordPress Sites Protected Against Unauthenticated Remote Code Execution Vulnerability Patched in GiveWP WordPress Plugin	RCE PHP Pop Chain PHP Object Injection Security Code Review	Wordfence	Villu Orav (@Villu164)
Spip Preauth RCE 2024: Part 1, The Feather	RCE Code Injection Security Code Review	SPIP	Laluka (@TheLaluka)
Vulnerabilities in NodeJS C/C++ add-on extensions	Memory Corruption Memory Leak Out-of-Bounds Read Buffer Overflow Integer Overflow DoS Security Code Review	Node.js Third-Party Modules	Alessio Della Libera
Front-End Frameworks: When Bypassing Built-in Sanitization Might Backfire	Client-Side Path Traversal XSS Security Code Review	Firefly III	Stefan Schiller (@Scryh_)
CVE-2024-38428 Wget Vulnerability: All you need to know	SSRF MiTM Phishing Data Leak Security Code Review	GNU Wget	Goni Golan
Github Actions Exploitation: Dependabot	CI/CD Arbitrary Code Push Security Code Review	Spring TRPC	Hugo Vincent (@Hugow_vincent)
Exploiting authorization by nonce in WordPress plugins	RCE Arbitrary File Upload SQL Injection Security Code Review	Wordfence	Bartek Nowotarski
Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail	XSS Security Code Review	Roundcube	Oskar Zeino-Mahmalat
Oracle Retail Xstore Suite: Pre-authenticated Path Traversal	Path Traversal Security Code Review	Oracle	Louis Wolfers (@TG91aXMK) Quentin Roland (@Croco_byte)
Hacking Moodle Apps Via External Functions	Broken Access Control Security Code Review	Undisclosed	Florian Walter
Path Traversal and Code Execution in CSLA.NET (CVE-2024-28698)	Path Traversal RCE Security Code Review	CSLA.NET	Sam Pizzey
Studying 0days: How we hacked Anki, the world's most popular flashcard app	RCE Components With Known Vulnerabilities Arbitrary File Read Arbitrary File Write XSS Security Code Review	Anki	Jacob Autumn Skerritt
JNDI Injection Remote Code Execution via Path Manipulation in MemoryUserDatabaseFactory	RCE JNDI Injection Security Code Review	Undisclosed	Steven Seeley (@Steventseeley)
SSD Advisory – XenForo RCE Via CSRF	RCE CSRF Security Code Review	XenForo	Egidio Romano / EgiX
How to Bypass Golang SSL Verification	SSL Verification Bypass Security Code Review	Undisclosed	Michael Pasternak

Page 1 of 12