Security Code Review | writeups.xyz

Title	Vulnerabilities	Programs	Authors
[P2O Vancouver 2023] SharePoint Pre-Auth RCE chain (CVE-2023–29357 & CVE-2023–24955)	RCE Authentication Bypass JWT Code Injection Security Code Review	Microsoft (Sharepoint)	Nguyễn Tiến Giang (@Testanull)
Exploiting ASP.NET TemplateParser — Part I: Sitecore (CVE-2023-35813)	RCE Security Code Review	Sitecore	Markus Wulftange (@Mwulftange)
Rooting Xiaomi WiFi Routers	OS Command Injection Buffer Overflow Memory Corruption Security Code Review	Xiaomi	Julien R. Marin Duroyon
DoubleQlik: Bypassing the Fix for CVE-2023-41265 to Achieve Unauthenticated Remote Code Execution	RCE Path Traversal HTTP Request Tunneling HTTP Request Smuggling Security Code Review	Qlik	Adam Crosser
Finding Deserialization Bugs In The Solarwind Platform	RCE Insecure Deserialization Security Code Review	SolarWinds	Piotr Bazydło (@Chudypb)
Remote Code Execution in Tutanota Desktop due to Code Flaw	XSS CSP Bypass Parsing Issue Electron RCE Security Code Review	Tutanota	Paul Gerste
Wind River VxWorks tarExtract directory traversal vulnerability (CVE-2023-38346)	Path Traversal Security Code Review	Wind River	Tobias Ospelt (@Floyd_ch) Martin Schobert
CraftCMS RCE	RCE Code Injection Security Code Review	Craft CMS	Thanh
Can't Be Contained: Finding a Command Injection Vulnerability in Kubernetes	RCE Command Injection Security Code Review	Kubernetes	Tomer Peled (@Tomerpeled92)
Blog: OmniSpace, from automated 0day XSS to RCE	RCE XSS Account Takeover CSRF Insecure File Upload LFI Security Code Review	Agora-Project (OmniSpace)	Florent (@Pepito_oh)
Code Vulnerabilities Put Skiff Emails at Risk	XSS Sandbox Bypass CSP Bypass Security Code Review	Skiff	Paul Gerste
Exploiting CVE-2017-11286 Six Years Later: XXE in ColdFusion via WDDX Packet	XXE Security Code Review	Adobe (ColdFusion)	Brian (@Hoyahaxa)
Finding A Pop Chain On A Common Symfony Bundle: Part 1	Insecure Deserialization Security Code Review	Doctrine-Bundle (Symfony Package)	Rémi Matasse (@_Remsio_)
MyBB Admin Panel RCE CVE-2023-41362	RCE ReDoS Security Code Review	MyBB	Sorcery IE (@SorceryIE)
Paranoids Vulnerability Research: Ivanti Issues Security Alert	RCE Insecure Deserialization Security Code Review	Ivanti	Blaine Herro
Kirby < 3.9.6 XML External Entity (XXE) vulnerability — CVE-2023-38490	XXE Security Code Review	Kirby	Bastian Allgeier (@Bastianallgeier) Lukas Bestle (@Lukasbestle)
Blog: CVE-2023-4634 - Tricky Unauthenticated RCE on Wordpress Media Library Assistant Plugin using a good old Imagick	LFI RCE Security Code Review	Media Library Assistant (WordPress Plugin)	Florent (@Pepito_oh)
When URL parsers disagree (CVE-2023-38633)	Path Traversal Security Code Review	Canva Librsvg	Zac Sims
ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal	RCE Path Traversal HTTP Request Tunneling HTTP Request Smuggling Security Code Review	Qlik	Adam Crosser
Hacking GTA V RP Servers Using Web Exploitation Techniques	Game Hacking XSS Security Code Review	Rockstar Games (FiveM)	Veritas (@Blastbots)
Leaking File Contents with a Blind File Oracle in Flarum	PHP Filter Chain Arbitrary File Read LFI Security Code Review	Flarum	Adam Kues (@Hash_kitten)
Playing Dominos with Moodle's Security (2/2)	Self-XSS Account Takeover OAuth Security Code Review	Moodle	Yaniv Nizry (@YNizry)
CVE-2023-36844 And Friends: RCE In Juniper Devices	RCE Missing Authentication Arbitrary File Upload Security Code Review	Juniper	WatchTowr (@Watchtowrcyber)
CVE-2023-35150: Arbitrary Code Injection In XWiki.Org XWiki	Code Injection Security Code Review	XWiki	Simon Humbert Lucas Miller
(CVE-2023-32530) Trend Micro Apex Central 2019 (<= Build 6016) Authenticated RCE	RCE SQL Injection Security Code Review	Trend Micro	Poh Jia Hao (@Chocologicall)

Page 6 of 12