GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Organization

Vulnerability Disclosure Archive

GNA-1988
GNA identifier
GNA-1988 GCVE registry Recent publications
Registered on 2026-09-04, last updated on 2026-09-10.

Recent vulnerabilities

387 GCVE records assigned by this organization as GNA-1988

GCVE-1988-2026-0074

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
Chronicle Wire v2026.8 Insecure Reflection Allows Unvalidated Method Invocation
Summary
Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events to Java handler methods. During initialization, the framework discovers public methods exposed by the registered handler interfaces and registers those methods as callable wire events. When a message is processed, the event name supplied within the wire data determines which registered handler method is selected. Method arguments are then deserialized from the corresponding message content, and Chronicle Wire invokes the selected method using Java Reflection. As a result, when untrusted wire data reaches a MethodReader, externally controlled input can determine both the handler method selected for invocation and the arguments supplied to that method. The dispatch surface is derived automatically from the handler's public interface rather than from an explicit list of individually registered operations. Public methods added to a registered handler interface can therefore become dispatchable wire events without separate method-level registration. This behavior becomes security-sensitive when a handler interface contains privileged or security-sensitive operations and its MethodReader processes data from an untrusted source. In such deployments, methods intended for file access, network operations, key management, maintenance, administrative functionality, or other privileged actions may become reachable through externally controlled event names. Vulnerability Details VanillaMethodReader constructs its dispatch surface from the handlers supplied by the application: addParsersForComponents(handler); During initialization, Chronicle Wire enumerates the public methods associated with the handler: for (Method method : handlerClass.getMethods()) { addParseletForMethod(method); } Eligible methods are subsequently registered for wire-event dispatch. The method name and parameter types are used to construct the corresponding wire key: MethodWireKey key = new MethodWireKey( method.getName(), parameterTypes); This means the set of methods callable through the wire protocol is derived from the public methods exposed by the registered handler interface. When incoming wire data is processed, the supplied event name is matched against the registered method dispatch table. The corresponding argument values are then deserialized according to the selected method's declared parameter types: arguments[i] = valueIn.object(parameterTypes[i]); After argument deserialization, the selected Java method is invoked reflectively: method.invoke(target, arguments); Consequently, externally controlled wire data participates directly in two security-sensitive decisions: selecting which registered handler method is executed and supplying the arguments passed to that method. The dispatch mechanism itself does not introduce a method-level authorization decision between event selection and invocation. The effective security boundary is therefore determined by which interfaces are registered with MethodReader, which public methods those interfaces expose, and whether the application permits untrusted data to reach the reader. Root Cause The security issue arises from automatically deriving the externally dispatchable method surface from public methods exposed by registered handler interfaces. Chronicle Wire: - Discovers public methods associated with registered handlers. - Registers eligible methods as wire-event handlers. - Resolves incoming event names to those methods. - Deserializes method parameters from the corresponding wire input. - Invokes the selected methods using Java Reflection. The dispatch model does not require each callable operation to be independently exported or registered at the method level. Consequently, the security boundary of a MethodReader can expand when additional public methods are introduced into an interface already used for wire dispatch. This creates a risk in applications where the registered handler interface contains operations that should not be reachable by the party controlling the wire input. The issue is particularly significant when interfaces evolve over time. Adding a new public operation to an existing MethodReader-facing interface can simultaneously add that operation to the wire dispatch surface without a separate dispatch registration step. Impact When untrusted input reaches a MethodReader, an attacker can select among the public operations exposed through the registered handler interface and provide serialized arguments for the selected operation. The resulting security impact depends on the functionality implemented by those handlers. Security-sensitive methods may include: - file access and file modification; - outbound network communication; - administrative operations; - key rotation or key-management operations; - configuration changes; - maintenance functionality; - state-changing business operations; and - other privileged application functionality. If such operations are exposed through a registered handler interface, externally controlled event names can cause those methods to be invoked with externally supplied arguments. The attack surface can also change as the application evolves. A public method added to an interface already participating in MethodReader dispatch may become a new wire operation without requiring separate registration of that individual method. Methods accepting broad or polymorphic argument types introduce an additional concern. Arguments are processed through Chronicle Wire's object deserialization mechanisms: arguments[i] = valueIn.object(parameterTypes[i]); Where the declared parameter type permits serialized type information to influence runtime object selection, externally controlled input may affect both the *method selected for invocation* and the *runtime object instantiated as its argument*. The resulting vulnerability therefore combines an externally controlled method-dispatch surface with attacker-controlled argument deserialization. The ultimate impact depends on the operations exposed by the registered handler and the trust boundary through which wire messages are received. Proof of Concept The proof of concept demonstrates that Chronicle Wire's MethodReader allows serialized event names to select public methods exposed by a registered handler and supplies those methods with arguments deserialized from the corresponding wire message. The tests exercise several handler operations to demonstrate method selection, privileged-operation reachability, automatic expansion of the dispatch surface, and typed argument deserialization. Administrative Method Invocation The registered handler exposes an administrative demonstration method named deleteAll. The following wire event was supplied: deleteAll: pwned-method-invocation Observed output: MethodReader invoked event-selected method: deleteAll:pwned-method-invocation This confirms that the event name supplied in the wire message selected the corresponding public handler method and that the attacker-controlled argument was delivered to that method. The demonstration method does not perform destructive deletion. Its purpose is to establish that an operation exposed by the registered handler can be selected directly through the incoming event name. File-Reading Method Invocation The handler additionally exposes a demonstration method that reads a caller-specified system file. The supplied event was: readSystemFile: /etc/hosts Observed invocation: MethodReader invoked file-reading method: readSystemFile:/etc/hosts The handler successfully accessed the supplied file and recorded: MethodReader file-read evidence: /etc/hosts:bytes=279:first-line=## The test therefore demonstrates more than method-name resolution. The externally supplied event selected a file-access operation and the externally supplied argument controlled the path processed by that operation. Automatic Exposure of Newly Added Handler Methods A new public method was added to the registered handler interface: void pingLocalhost(int port); No individual MethodReader registration was added for pingLocalhost. The following wire event was then supplied: pingLocalhost: 61866 Observed output: MethodReader invoked loopback ping method: pingLocalhost:61866 The test additionally recorded the resulting loopback interaction: MethodReader loopback ping evidence: pingLocalhost:127.0.0.1:61866 This confirms that adding the method to the registered handler interface was sufficient for the operation to become part of the MethodReader dispatch surface. The test is significant because it demonstrates that the callable surface can expand as the handler interface evolves. A newly introduced public handler operation does not require separate method-level registration before it can be selected by a corresponding wire event. Process-Execution Demonstration The automatic dispatch behavior was further tested with a deliberately introduced handler method containing a process-execution operation: void runtimeExecEcho(String command); The following event was supplied: runtimeExecEcho: pwned-runtime-exec Observed invocation: MethodReader invoked Runtime.exec method: runtimeExecEcho:pwned-runtime-exec The test recorded successful process execution: MethodReader Runtime.exec evidence: command=/bin/echo pwned-runtime-exec, exit=0 Process output: pwned-runtime-exec This test does not establish that Chronicle Wire itself contains a built-in command-execution method or universal RCE gadget. The runtimeExecEcho method was intentionally introduced as a controlled demonstration of the security consequence when a privileged operation exists on a registered handler interface. The result confirms the underlying dispatch property: once the public method was present on the handler interface, the corresponding wire event could select and invoke it without separate method-level registration. Typed Object Argument Deserialization The PoC additionally demonstrates that MethodReader dispatch can interact with Chronicle Wire's typed object deserialization when a handler accepts a sufficiently broad parameter type. The supplied event contained a tagged object: acceptObject: !net.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe { marker: proof } Observed output: MethodReader typed argument instantiated class: net.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe MethodReader typed argument constructor calls: 1 MethodReader typed argument readMarshallable calls: 1 This confirms that MethodReader did not simply pass a textual representation of the supplied argument to the handler. The argument entered Chronicle Wire's object deserialization path, the class identified by the serialized type information was instantiated, its constructor executed, and its readMarshallable() callback was invoked. For handler methods accepting broad or polymorphic parameter types, externally controlled wire input may therefore influence both the handler operation selected for invocation and the runtime object created as its argument. PoC Results The runtime evidence confirms the following MethodReader behaviors: [CONFIRMED] Wire event selected deleteAll handler method [CONFIRMED] Attacker-controlled argument delivered to selected method [CONFIRMED] Wire event selected readSystemFile handler method [CONFIRMED] Supplied /etc/hosts path processed by handler [CONFIRMED] File contents successfully read [CONFIRMED] Newly added pingLocalhost method became dispatchable [CONFIRMED] No separate method-level registration was required [CONFIRMED] Loopback network interaction occurred [CONFIRMED] Newly added runtimeExecEcho method became dispatchable [CONFIRMED] Demonstration process executed successfully [CONFIRMED] /bin/echo exited with status 0
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
unknown Chronicle Wire Affected: unknown
Create a notification for this product.
Credits
Ron E
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Chronicle Wire",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chronicle Wire\u0027s MethodReader implements message dispatch by dynamically\nmapping serialized wire events to Java handler methods. During\ninitialization, the framework discovers public methods exposed by the\nregistered handler interfaces and registers those methods as callable wire\nevents.\n\nWhen a message is processed, the event name supplied within the wire data\ndetermines which registered handler method is selected. Method arguments\nare then deserialized from the corresponding message content, and Chronicle\nWire invokes the selected method using Java Reflection.\n\nAs a result, when untrusted wire data reaches a MethodReader, externally\ncontrolled input can determine both the handler method selected for\ninvocation and the arguments supplied to that method.\n\nThe dispatch surface is derived automatically from the handler\u0027s public\ninterface rather than from an explicit list of individually registered\noperations. Public methods added to a registered handler interface can\ntherefore become dispatchable wire events without separate method-level\nregistration.\n\nThis behavior becomes security-sensitive when a handler interface contains\nprivileged or security-sensitive operations and its MethodReader processes\ndata from an untrusted source. In such deployments, methods intended for\nfile access, network operations, key management, maintenance,\nadministrative functionality, or other privileged actions may become\nreachable through externally controlled event names.\nVulnerability Details\n\nVanillaMethodReader constructs its dispatch surface from the handlers\nsupplied by the application:\n\naddParsersForComponents(handler);\n\nDuring initialization, Chronicle Wire enumerates the public methods\nassociated with the handler:\n\nfor (Method method : handlerClass.getMethods()) {\n    addParseletForMethod(method);\n}\n\nEligible methods are subsequently registered for wire-event dispatch.\n\nThe method name and parameter types are used to construct the corresponding\nwire key:\n\nMethodWireKey key =\n    new MethodWireKey(\n        method.getName(),\n        parameterTypes);\n\nThis means the set of methods callable through the wire protocol is derived\nfrom the public methods exposed by the registered handler interface.\n\nWhen incoming wire data is processed, the supplied event name is matched\nagainst the registered method dispatch table. The corresponding argument\nvalues are then deserialized according to the selected method\u0027s declared\nparameter types:\n\narguments[i] =\n    valueIn.object(parameterTypes[i]);\n\nAfter argument deserialization, the selected Java method is invoked\nreflectively:\n\nmethod.invoke(target, arguments);\n\nConsequently, externally controlled wire data participates directly in two\nsecurity-sensitive decisions: selecting which registered handler method is\nexecuted and supplying the arguments passed to that method.\n\nThe dispatch mechanism itself does not introduce a method-level\nauthorization decision between event selection and invocation. The\neffective security boundary is therefore determined by which interfaces are\nregistered with MethodReader, which public methods those interfaces expose,\nand whether the application permits untrusted data to reach the reader.\nRoot Cause\n\nThe security issue arises from automatically deriving the externally\ndispatchable method surface from public methods exposed by registered\nhandler interfaces.\n\nChronicle Wire:\n\n   -\n\n   Discovers public methods associated with registered handlers.\n   -\n\n   Registers eligible methods as wire-event handlers.\n   -\n\n   Resolves incoming event names to those methods.\n   -\n\n   Deserializes method parameters from the corresponding wire input.\n   -\n\n   Invokes the selected methods using Java Reflection.\n\nThe dispatch model does not require each callable operation to be\nindependently exported or registered at the method level. Consequently, the\nsecurity boundary of a MethodReader can expand when additional public\nmethods are introduced into an interface already used for wire dispatch.\n\nThis creates a risk in applications where the registered handler interface\ncontains operations that should not be reachable by the party controlling\nthe wire input.\n\nThe issue is particularly significant when interfaces evolve over time.\nAdding a new public operation to an existing MethodReader-facing interface\ncan simultaneously add that operation to the wire dispatch surface without\na separate dispatch registration step.\nImpact\n\nWhen untrusted input reaches a MethodReader, an attacker can select among\nthe public operations exposed through the registered handler interface and\nprovide serialized arguments for the selected operation.\n\nThe resulting security impact depends on the functionality implemented by\nthose handlers.\n\nSecurity-sensitive methods may include:\n\n   -\n\n   file access and file modification;\n   -\n\n   outbound network communication;\n   -\n\n   administrative operations;\n   -\n\n   key rotation or key-management operations;\n   -\n\n   configuration changes;\n   -\n\n   maintenance functionality;\n   -\n\n   state-changing business operations; and\n   -\n\n   other privileged application functionality.\n\nIf such operations are exposed through a registered handler interface,\nexternally controlled event names can cause those methods to be invoked\nwith externally supplied arguments.\n\nThe attack surface can also change as the application evolves. A public\nmethod added to an interface already participating in MethodReader dispatch\nmay become a new wire operation without requiring separate registration of\nthat individual method.\n\nMethods accepting broad or polymorphic argument types introduce an\nadditional concern. Arguments are processed through Chronicle Wire\u0027s object\ndeserialization mechanisms:\n\narguments[i] =\n    valueIn.object(parameterTypes[i]);\n\nWhere the declared parameter type permits serialized type information to\ninfluence runtime object selection, externally controlled input may affect\nboth the *method selected for invocation* and the *runtime object\ninstantiated as its argument*.\n\nThe resulting vulnerability therefore combines an externally controlled\nmethod-dispatch surface with attacker-controlled argument deserialization.\nThe ultimate impact depends on the operations exposed by the registered\nhandler and the trust boundary through which wire messages are received.\n\nProof of Concept\n\nThe proof of concept demonstrates that Chronicle Wire\u0027s MethodReader allows\nserialized event names to select public methods exposed by a registered\nhandler and supplies those methods with arguments deserialized from the\ncorresponding wire message.\n\nThe tests exercise several handler operations to demonstrate method\nselection, privileged-operation reachability, automatic expansion of the\ndispatch surface, and typed argument deserialization.\nAdministrative Method Invocation\n\nThe registered handler exposes an administrative demonstration method named\ndeleteAll.\n\nThe following wire event was supplied:\n\ndeleteAll: pwned-method-invocation\n\nObserved output:\n\nMethodReader invoked event-selected method:\ndeleteAll:pwned-method-invocation\n\nThis confirms that the event name supplied in the wire message selected the\ncorresponding public handler method and that the attacker-controlled\nargument was delivered to that method.\n\nThe demonstration method does not perform destructive deletion. Its purpose\nis to establish that an operation exposed by the registered handler can be\nselected directly through the incoming event name.\nFile-Reading Method Invocation\n\nThe handler additionally exposes a demonstration method that reads a\ncaller-specified system file.\n\nThe supplied event was:\n\nreadSystemFile: /etc/hosts\n\nObserved invocation:\n\nMethodReader invoked file-reading method:\nreadSystemFile:/etc/hosts\n\nThe handler successfully accessed the supplied file and recorded:\n\nMethodReader file-read evidence:\n/etc/hosts:bytes=279:first-line=##\n\nThe test therefore demonstrates more than method-name resolution. The\nexternally supplied event selected a file-access operation and the\nexternally supplied argument controlled the path processed by that\noperation.\nAutomatic Exposure of Newly Added Handler Methods\n\nA new public method was added to the registered handler interface:\n\nvoid pingLocalhost(int port);\n\nNo individual MethodReader registration was added for pingLocalhost.\n\nThe following wire event was then supplied:\n\npingLocalhost: 61866\n\nObserved output:\n\nMethodReader invoked loopback ping method:\npingLocalhost:61866\n\nThe test additionally recorded the resulting loopback interaction:\n\nMethodReader loopback ping evidence:\npingLocalhost:127.0.0.1:61866\n\nThis confirms that adding the method to the registered handler interface\nwas sufficient for the operation to become part of the MethodReader\ndispatch surface.\n\nThe test is significant because it demonstrates that the callable surface\ncan expand as the handler interface evolves. A newly introduced public\nhandler operation does not require separate method-level registration\nbefore it can be selected by a corresponding wire event.\nProcess-Execution Demonstration\n\nThe automatic dispatch behavior was further tested with a deliberately\nintroduced handler method containing a process-execution operation:\n\nvoid runtimeExecEcho(String command);\n\nThe following event was supplied:\n\nruntimeExecEcho: pwned-runtime-exec\n\nObserved invocation:\n\nMethodReader invoked Runtime.exec method:\nruntimeExecEcho:pwned-runtime-exec\n\nThe test recorded successful process execution:\n\nMethodReader Runtime.exec evidence:\ncommand=/bin/echo pwned-runtime-exec, exit=0\n\nProcess output:\n\npwned-runtime-exec\n\nThis test does not establish that Chronicle Wire itself contains a built-in\ncommand-execution method or universal RCE gadget. The runtimeExecEcho\nmethod was intentionally introduced as a controlled demonstration of the\nsecurity consequence when a privileged operation exists on a registered\nhandler interface.\n\nThe result confirms the underlying dispatch property: once the public\nmethod was present on the handler interface, the corresponding wire event\ncould select and invoke it without separate method-level registration.\nTyped Object Argument Deserialization\n\nThe PoC additionally demonstrates that MethodReader dispatch can interact\nwith Chronicle Wire\u0027s typed object deserialization when a handler accepts a\nsufficiently broad parameter type.\n\nThe supplied event contained a tagged object:\n\nacceptObject:\n  !net.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe {\n      marker: proof\n  }\n\nObserved output:\n\nMethodReader typed argument instantiated class:\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe\n\nMethodReader typed argument constructor calls: 1\n\nMethodReader typed argument readMarshallable calls: 1\n\nThis confirms that MethodReader did not simply pass a textual\nrepresentation of the supplied argument to the handler.\n\nThe argument entered Chronicle Wire\u0027s object deserialization path, the\nclass identified by the serialized type information was instantiated, its\nconstructor executed, and its readMarshallable() callback was invoked.\n\nFor handler methods accepting broad or polymorphic parameter types,\nexternally controlled wire input may therefore influence both the handler\noperation selected for invocation and the runtime object created as its\nargument.\nPoC Results\n\nThe runtime evidence confirms the following MethodReader behaviors:\n\n[CONFIRMED] Wire event selected deleteAll handler method\n[CONFIRMED] Attacker-controlled argument delivered to selected method\n\n[CONFIRMED] Wire event selected readSystemFile handler method\n[CONFIRMED] Supplied /etc/hosts path processed by handler\n[CONFIRMED] File contents successfully read\n\n[CONFIRMED] Newly added pingLocalhost method became dispatchable\n[CONFIRMED] No separate method-level registration was required\n[CONFIRMED] Loopback network interaction occurred\n\n[CONFIRMED] Newly added runtimeExecEcho method became dispatchable\n[CONFIRMED] Demonstration process executed successfully\n[CONFIRMED] /bin/echo exited with status 0\n"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/102"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/102"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/102"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Chronicle Wire v2026.8 Insecure Reflection Allows Unvalidated Method Invocation",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0074",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/102",
            "automated": true,
            "contentSha256": "bbe8e54d524a45f120a262f1513e18e475b3fd19d5803ec612ee1b582cd7d0c1",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/102",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T12:42:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0074"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0073

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection
Summary
Chronicle Wire's FileMarshallableOut follows symbolic links when writing files in append mode. When ?append=true is enabled, the implementation opens the supplied output path directly using FileOutputStream(path, true) without preventing symbolic-link resolution. If an attacker can create or replace the expected output file with a symbolic link before the append operation occurs, the operating system resolves the link and Chronicle Wire writes to the link target using the privileges of the application process. This can redirect application-generated output from its intended destination to another file writable by the application. The proof of concept confirms that an append operation directed at a symbolic-link path modifies the underlying target file. A separate boundary test confirms that non-append overwrite mode does not exhibit the same behavior: the symbolic-link path is replaced while the original target remains unchanged. The vulnerability is therefore specifically limited to the append-mode file-opening path. Vulnerability Details FileMarshallableOut determines the destination used for file output based on whether append mode is enabled: final String path = url.getPath(); final String path0 = options.append ? path : (path + ".tmp"); When append mode is disabled, Chronicle Wire writes through a temporary path. When append mode is enabled, however, path0 directly references the supplied destination: path0 = path; The resulting file is opened using: try (FileOutputStream out = new FileOutputStream(path0, options.append)) { final Bytes<byte[]> bytes = Jvm.uncheckedCast(wire.bytes()); out.write( bytes.underlyingObject(), 0, (int) bytes.readLimit()); } In append mode, the effective operation is therefore: new FileOutputStream(path, true); No protection against symbolic-link resolution is applied when this file is opened. If path identifies a symbolic link, normal filesystem resolution causes the underlying target to be opened and modified. The existing path validation does not prevent this condition: String path = url.getPath(); if (path == null || path.isEmpty() || path.contains("..")) throw new IllegalArgumentException( "Invalid file path: " + path); This prevents certain malformed or traversal-style paths but does not protect the final destination from symbolic-link substitution. Root Cause The append implementation opens the destination using a filesystem operation that follows symbolic links without enforcing a no-follow policy. The vulnerability does not require .. traversal or an unusual path syntax. The apparent destination itself can be a valid filesystem path while referencing a symbolic link created or substituted by another user or process. This creates a security issue when there is a privilege or trust-boundary difference between the process performing the append operation and the party capable of manipulating the destination filesystem entry. For example, a less-privileged attacker may be able to create or replace a predictable output file within a shared or attacker-writable directory. If a more privileged application subsequently performs a FileMarshallableOut append against that path, the resulting write can be redirected to a different file accessible to the application. Security Impact An attacker capable of manipulating the filesystem entry used as an append destination may redirect Chronicle Wire output to another file writable by the application's privileges. Potential consequences depend on the target application's filesystem permissions and the contents being written. Affected deployment patterns may include applications writing to: - shared writable directories; - predictable temporary locations; - application export directories; - CI/CD workspaces; - shared container volumes; - cache or working directories; - plugin-controlled filesystem locations; or - other locations where a less-privileged party can manipulate destination entries. The confirmed security primitive is *file write redirection through symbolic-link following*. The proof of concept does not establish arbitrary file overwrite because the affected operation uses append semantics. The attacker-selected target must also be writable by the application process. Proof of Concept The proof of concept creates an ordinary target file containing: before A symbolic link named: safe-looking-output.yaml is then created pointing to: target.txt Chronicle Wire is instructed to write to safe-looking-output.yaml with append mode enabled. The apparent destination is therefore the symbolic-link path, while the actual filesystem object modified by the operation is target.txt. Observed Results The test confirmed the symbolic-link destination and target: FileMarshallableOut append followed symlink: /.../safe-looking-output.yaml FileMarshallableOut symlink target: /.../target.txt Before the Chronicle Wire operation, the target contained: FileMarshallableOut symlink content before BEGIN before FileMarshallableOut symlink content before END The value supplied to FileMarshallableOut was: FileMarshallableOut symlink value written: message=symlink-append-proof After the append operation, the target contained: FileMarshallableOut symlink content after BEGIN before message: symlink-append-proof ... FileMarshallableOut symlink content after END The original contents remained and the Chronicle Wire output was appended directly to the symbolic-link target. This confirms that FileMarshallableOut followed the symbolic link during the append operation. Boundary Validation Non-append mode was tested separately to determine whether the behavior affected all FileMarshallableOut file writes. The original target contained: before After performing the non-append operation through the symbolic-link path, the original target still contained: before The test confirmed that non-append processing replaced the symbolic-link path rather than following the link and modifying its original target. The demonstrated vulnerability is therefore specifically associated with: ?append=true and the corresponding: new FileOutputStream(path, true); file-opening path. PoC Results The security test confirmed the following behavior: [CONFIRMED] Append destination was a symbolic link[CONFIRMED] Symbolic link referenced a separate target file[CONFIRMED] Chronicle Wire opened the apparent destination in append mode[CONFIRMED] Output was written to the symbolic-link target[CONFIRMED] Original target contents remained intact[CONFIRMED] Chronicle Wire data was appended to the target[CONFIRMED] Non-append mode did not modify the original symlink target The runtime evidence demonstrates that append-mode output can cross the apparent filesystem boundary established by the supplied destination path. Ron Edgerson Vulnerability Researcher & Exploit Developer CVE Research | Binary Exploitation | Application & Systems Security Responsible Disclosure • Proof-of-Concept Development 🌐 https://github.com/ob1sec 🔗 https://www.linkedin.com/in/ronedgerson1 <https://linkedin.com/in/yourhandle> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
unknown Chronicle Wire Affected: unknown
Create a notification for this product.
Credits
Ron E
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Chronicle Wire",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chronicle Wire\u0027s FileMarshallableOut follows symbolic links when writing\nfiles in append mode. When ?append=true is enabled, the implementation\nopens the supplied output path directly using FileOutputStream(path, true)\nwithout preventing symbolic-link resolution.\n\nIf an attacker can create or replace the expected output file with a\nsymbolic link before the append operation occurs, the operating system\nresolves the link and Chronicle Wire writes to the link target using the\nprivileges of the application process.\n\nThis can redirect application-generated output from its intended\ndestination to another file writable by the application.\n\nThe proof of concept confirms that an append operation directed at a\nsymbolic-link path modifies the underlying target file. A separate boundary\ntest confirms that non-append overwrite mode does not exhibit the same\nbehavior: the symbolic-link path is replaced while the original target\nremains unchanged.\n\nThe vulnerability is therefore specifically limited to the append-mode\nfile-opening path.\nVulnerability Details\n\nFileMarshallableOut determines the destination used for file output based\non whether append mode is enabled:\n\nfinal String path = url.getPath();\nfinal String path0 = options.append ? path : (path + \".tmp\");\n\nWhen append mode is disabled, Chronicle Wire writes through a temporary\npath.\n\nWhen append mode is enabled, however, path0 directly references the\nsupplied destination:\n\npath0 = path;\n\nThe resulting file is opened using:\n\ntry (FileOutputStream out =\n         new FileOutputStream(path0, options.append)) {\n\n    final Bytes\u003cbyte[]\u003e bytes =\n        Jvm.uncheckedCast(wire.bytes());\n\n    out.write(\n        bytes.underlyingObject(),\n        0,\n        (int) bytes.readLimit());\n}\n\nIn append mode, the effective operation is therefore:\n\nnew FileOutputStream(path, true);\n\nNo protection against symbolic-link resolution is applied when this file is\nopened.\n\nIf path identifies a symbolic link, normal filesystem resolution causes the\nunderlying target to be opened and modified.\n\nThe existing path validation does not prevent this condition:\n\nString path = url.getPath();\n\nif (path == null ||\n    path.isEmpty() ||\n    path.contains(\"..\"))\n    throw new IllegalArgumentException(\n        \"Invalid file path: \" + path);\n\nThis prevents certain malformed or traversal-style paths but does not\nprotect the final destination from symbolic-link substitution.\nRoot Cause\n\nThe append implementation opens the destination using a filesystem\noperation that follows symbolic links without enforcing a no-follow policy.\n\nThe vulnerability does not require .. traversal or an unusual path syntax.\nThe apparent destination itself can be a valid filesystem path while\nreferencing a symbolic link created or substituted by another user or\nprocess.\n\nThis creates a security issue when there is a privilege or trust-boundary\ndifference between the process performing the append operation and the\nparty capable of manipulating the destination filesystem entry.\n\nFor example, a less-privileged attacker may be able to create or replace a\npredictable output file within a shared or attacker-writable directory. If\na more privileged application subsequently performs a FileMarshallableOut\nappend against that path, the resulting write can be redirected to a\ndifferent file accessible to the application.\nSecurity Impact\n\nAn attacker capable of manipulating the filesystem entry used as an append\ndestination may redirect Chronicle Wire output to another file writable by\nthe application\u0027s privileges.\n\nPotential consequences depend on the target application\u0027s filesystem\npermissions and the contents being written.\n\nAffected deployment patterns may include applications writing to:\n\n   - shared writable directories;\n   - predictable temporary locations;\n   - application export directories;\n   - CI/CD workspaces;\n   - shared container volumes;\n   - cache or working directories;\n   - plugin-controlled filesystem locations; or\n   - other locations where a less-privileged party can manipulate\n   destination entries.\n\nThe confirmed security primitive is *file write redirection through\nsymbolic-link following*.\n\nThe proof of concept does not establish arbitrary file overwrite because\nthe affected operation uses append semantics. The attacker-selected target\nmust also be writable by the application process.\nProof of Concept\n\nThe proof of concept creates an ordinary target file containing:\n\nbefore\n\nA symbolic link named:\n\nsafe-looking-output.yaml\n\nis then created pointing to:\n\ntarget.txt\n\nChronicle Wire is instructed to write to safe-looking-output.yaml with\nappend mode enabled.\n\nThe apparent destination is therefore the symbolic-link path, while the\nactual filesystem object modified by the operation is target.txt.\nObserved Results\n\nThe test confirmed the symbolic-link destination and target:\n\nFileMarshallableOut append followed symlink:\n/.../safe-looking-output.yaml\n\nFileMarshallableOut symlink target:\n/.../target.txt\n\nBefore the Chronicle Wire operation, the target contained:\n\nFileMarshallableOut symlink content before BEGIN\nbefore\nFileMarshallableOut symlink content before END\n\nThe value supplied to FileMarshallableOut was:\n\nFileMarshallableOut symlink value written:\nmessage=symlink-append-proof\n\nAfter the append operation, the target contained:\n\nFileMarshallableOut symlink content after BEGIN\nbefore\nmessage: symlink-append-proof\n...\nFileMarshallableOut symlink content after END\n\nThe original contents remained and the Chronicle Wire output was appended\ndirectly to the symbolic-link target.\n\nThis confirms that FileMarshallableOut followed the symbolic link during\nthe append operation.\nBoundary Validation\n\nNon-append mode was tested separately to determine whether the behavior\naffected all FileMarshallableOut file writes.\n\nThe original target contained:\n\nbefore\n\nAfter performing the non-append operation through the symbolic-link path,\nthe original target still contained:\n\nbefore\n\nThe test confirmed that non-append processing replaced the symbolic-link\npath rather than following the link and modifying its original target.\n\nThe demonstrated vulnerability is therefore specifically associated with:\n\n?append=true\n\nand the corresponding:\n\nnew FileOutputStream(path, true);\n\nfile-opening path.\nPoC Results\n\nThe security test confirmed the following behavior:\n\n[CONFIRMED] Append destination was a symbolic link[CONFIRMED] Symbolic\nlink referenced a separate target file[CONFIRMED] Chronicle Wire\nopened the apparent destination in append mode[CONFIRMED] Output was\nwritten to the symbolic-link target[CONFIRMED] Original target\ncontents remained intact[CONFIRMED] Chronicle Wire data was appended\nto the target[CONFIRMED] Non-append mode did not modify the original\nsymlink target\n\nThe runtime evidence demonstrates that append-mode output can cross the\napparent filesystem boundary established by the supplied destination path.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/83"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/83"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/83"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0073",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/83",
            "automated": true,
            "contentSha256": "5de50e3c1671bae7dda757a3dc128e36b921139464af78fca0496bf95f07f08c",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/83",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T12:41:27Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0073"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0072

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)
Summary
TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in Workflow Enterprise 9.1.0.1. Type: Pre-authentication RCE (expression injection) (CWE-94) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated root RCE on the Joget application server; full control of the workflow automation platform and its integrated ERP and approval systems. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/joget-jrxml-expr-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Workflow Enterprise",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Workflow Enterprise 9.1.0.1.\n\nType: Pre-authentication RCE (expression injection) (CWE-94)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated root RCE on the Joget application server; full control of the workflow automation platform and \nits integrated ERP and approval systems.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/joget-jrxml-expr-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/51"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/51"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/joget-jrxml-expr-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/51"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0072",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/51",
            "automated": true,
            "contentSha256": "02f6d5cb1cd6f8ea07966e7abd2572653b35fe1f77feea8d633b3894a16f7550",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/51",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:26:21Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0072"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0070

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Vocia MS-1 Firmware 1.2.27 Pre-authentication RCE (hardcoded credentials + supervisor execution) (9.8)
Summary
TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Vocia MS-1 Firmware 1.2.27 Pre-authentication RCE (hardcoded credentials + supervisor execution) (9.8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in Vocia MS-1 Firmware 1.2.27. Type: Pre-authentication RCE (hardcoded credentials + supervisor execution) (CWE-798) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated root code execution on the device; full control of public-address and intercom infrastructure in transportation hubs, government buildings, schools, and hospitals. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/biamp-vocia-ftps-root Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Vocia MS-1 Firmware",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Vocia MS-1 Firmware 1.2.27 Pre-authentication RCE (hardcoded credentials + supervisor \nexecution) (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Vocia MS-1 Firmware 1.2.27.\n\nType: Pre-authentication RCE (hardcoded credentials + supervisor execution) (CWE-798)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated root code execution on the device; full control of public-address and intercom infrastructure \nin transportation hubs, government buildings, schools, and hospitals.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/biamp-vocia-ftps-root\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/49"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/49"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/biamp-vocia-ftps-root"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/49"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Vocia MS-1 Firmware 1.2.27 Pre-authentication RCE (hardcoded credentials + supervisor execution) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0070",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/49",
            "automated": true,
            "contentSha256": "1899f46f089abde0e21181ef8422c9d0cb1b8fbf6cde44b21e6c42c26054b5af",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/49",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:25:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0070"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0069

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Enterprise ADC 8.13.8 Authenticated RCE (command injection + passwordless sudo) (8.8)
Summary
TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Enterprise ADC 8.13.8 Authenticated RCE (command injection + passwordless sudo) (8.8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in Enterprise ADC 8.13.8. Type: Authenticated RCE (command injection + passwordless sudo) (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Impact: Full device compromise as root on the load balancer, placing the north-south traffic of the networks it fronts at risk. Authentication: authenticated (requires valid session) Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/loadbalancer-org-template-root Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
unknown Enterprise ADC Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Enterprise ADC",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Enterprise ADC 8.13.8 Authenticated RCE (command injection + passwordless sudo) (8.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Enterprise ADC 8.13.8.\n\nType: Authenticated RCE (command injection + passwordless sudo) (CWE-78)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: Full device compromise as root on the load balancer, placing the north-south traffic of the networks it fronts \nat risk.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/loadbalancer-org-template-root\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/48"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/48"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/loadbalancer-org-template-root"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/48"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Enterprise ADC 8.13.8 Authenticated RCE (command injection + passwordless sudo) (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0069",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/48",
            "automated": true,
            "contentSha256": "d2125463400ff55206ce0149e2af261c2d5a94694400d962b32bd5e1ebba0d86",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/48",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:25:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0069"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0068

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] KeyHelp 26.0 (Build 3624) Authenticated RCE (command injection via Apache directive) (7.2)
Summary
TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] KeyHelp 26.0 (Build 3624) Authenticated RCE (command injection via Apache directive) (7.2) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in KeyHelp 26.0 (Build 3624). Type: Authenticated RCE (command injection via Apache directive) (CWE-78) CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Impact: Admin-to-root full server takeover. All hosted domains, customer data, panel data, and other host services are at risk. Authentication: authenticated (requires valid session) Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/keyhelp-errorlog-pipe-root Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
unknown KeyHelp Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "KeyHelp",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] KeyHelp 26.0 (Build 3624) Authenticated RCE (command injection via Apache directive) (7.2)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in KeyHelp 26.0 (Build 3624).\n\nType: Authenticated RCE (command injection via Apache directive) (CWE-78)\nCVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)\nImpact: Admin-to-root full server takeover. All hosted domains, customer data, panel data, and other host services are \nat risk.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/keyhelp-errorlog-pipe-root\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/47"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/47"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/keyhelp-errorlog-pipe-root"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/47"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] KeyHelp 26.0 (Build 3624) Authenticated RCE (command injection via Apache directive) (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0068",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/47",
            "automated": true,
            "contentSha256": "d962537034f728c5c58a238b12f5821a3f7c1fbe4579b5e32a9f3c839e991c3f",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/47",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:25:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0068"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0066

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] InsightEdge Enterprise (XAP IMDg) 16.1.1 Pre-authentication RCE (path traversal + JSP webshell) (9.8)
Summary
TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] InsightEdge Enterprise (XAP IMDg) 16.1.1 Pre-authentication RCE (path traversal + JSP webshell) (9.8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in InsightEdge Enterprise (XAP IMDg) 16.1.1. Type: Pre-authentication RCE (path traversal + JSP webshell) (CWE-22) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated arbitrary file write and root command execution on the management host and data grid, including the in-memory data and analytics platforms serving transaction processing. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/gigaspaces-xap-unauth-webshell Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "InsightEdge Enterprise XAP",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] InsightEdge Enterprise (XAP IMDg) 16.1.1 Pre-authentication RCE (path traversal + JSP webshell) \n(9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in InsightEdge Enterprise (XAP IMDg) 16.1.1.\n\nType: Pre-authentication RCE (path traversal + JSP webshell) (CWE-22)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated arbitrary file write and root command execution on the management host and data grid, including \nthe in-memory data and analytics platforms serving transaction processing.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/gigaspaces-xap-unauth-webshell\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/45"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/45"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/gigaspaces-xap-unauth-webshell"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/45"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] InsightEdge Enterprise (XAP IMDg) 16.1.1 Pre-authentication RCE (path traversal + JSP webshell) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0066",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/45",
            "automated": true,
            "contentSha256": "7ce1b56623fb98ab73bcbe8548c242f7e930f9a43ea854275a36dcd2fcaacea8",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/45",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:24:59Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0066"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0064

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
SCHUTZWERK-SA-2025-001: Authentication Bypass for SafeLine SL6 and SL6+
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Authentication Bypass for SafeLine SL6 and SL6+ =============================================== gain unauthorized administrative access to the device configuration. Metadata ======== * Affected product: SafeLine SL6/SL6+ * Affected version: Introduced in version 4.82, patched in version 4.97 * Vendor: SafeLine * Problem type(s): CWE-305 Authentication bypass by primary weakness * CVE ID: CVE-2025-4994 * CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-4994 * CVSS 4.0 score: 8.7 * Advisory URL: https://www.schutzwerk.com/blog/schutzwerk-sa-2025-001/ Details ======= depending on the "Auto Enable BLE" configuration setting:   by a configurable PIN.   enabled by a reboot. to the target device and is fully reproducible. Risk ==== an incident. Workaround ========== interface. Solution/Mitigation =================== should be applied. Timeline ======== * 2025-03-28 Vulnerability discovered * 2025-04-14 Initial contact with vendor * 2025-04-16 Vulnerability reported to technical support of vendor * 2025-05-08 Follow-up meeting was canceled by vendor * 2025-05-16 Initial contact with CTO of vendor * 2025-05-28 Vulnerability presented to CTO of vendor * 2025-06-16 Vendor informed SCHUTZWERK that the patch is currently tested * 2025-07-03 Follow-up meeting was canceled by vendor * 2025-07-31 Follow-up meeting was requested by SCHUTZWERK * 2025-08-21 Vendor informed SCHUTZWERK that the patch was postponed * 2025-08-28 Vendor informed SCHUTZWERK that the patch is currently tested * 2025-12-19 Vendor informed SCHUTZWERK that the patch was released   scheduled maintenance windows * 2026-06-19 Advisory released by SCHUTZWERK Credits ======= The vulnerability was discovered by Jan Hüber of SCHUTZWERK GmbH -----BEGIN PGP SIGNATURE----- iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmpLjrQaHGFkdmlzb3Jp ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLruNEA/+IiLtH9rqkwhZA3H0qWQp Z6xH/M7Som+OkCn/qgZ7khBKi2qsC0jdA7ePf/D3LY2VlgA9Y60fAETXarNj2X/y KgB80TjrPRwBhPhdZKxhn14DCPjLANGVYVDanfR0oQmRzZ8aEjb9No6G04nb+qCV u7c1aD5Hl0vJRI7AAgkHjz1etgsYm7MKkJYHxhCuJFw2B4XpPjk9TREgofdC3FLk VkO5xMRUysMy9Sgy8qzesSySX5UHKoPVtndo/EVvDsUJccsIL6WdE4z4odMJ9cRE r8CX6LAnyhfktgDf8eOgzysfdkYl//0KO1IIGF8ghLqRDpgWkMZTHc2/GXPnPYL1 3uIXI7vG8jGJ99fIijocplug9BAnQnK+w7PBJOzroWMOQC7zJWwy6gL2H/vYIatp FQFlgF5DnMBdjWX80Gu5CIDPYIVlXW15k7TNF/k5XUW3Uh6/uk8FTLgzPFsR707j XsWPKk7XICiizJDv2su8rmTtCpPtgHhC0HUoJa6eVBj+37l4EuPS0jpYEByfkmNY e+eka/F0kF4FzxAp2jWfE4A+QLlP6GGgZSLlfybVgvsjUe468intIDHaR9CPlv74 DtLWZ3zr4OXTare4hm7F0dLN80WAG3A6ELsrqGknaKvD4ePaSBLdkL8q9tKZIQL5 MUv9NZtj3B224OsNyt8EhjA= =JAMF -----END PGP SIGNATURE----- -- SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany Zertifiziert / Certified ISO 27001, 9001 and TISAX Phone +49 731 977 191 0 advisories () schutzwerk com / www.schutzwerk.com Geschäftsführer / Managing Directors: Jakob Pietzka, Michael Schäfer Amtsgericht Ulm / HRB 727391 Datenschutz / Data Protection www.schutzwerk.com/datenschutz _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
Jan Hüber via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2025-001 Authentication Bypass",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jan H\u00fcber via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAuthentication Bypass for SafeLine SL6 and SL6+\n===============================================\n\n\ngain unauthorized administrative access to the device configuration.\n\nMetadata\n========\n\n* Affected product: SafeLine SL6/SL6+\n* Affected version: Introduced in version 4.82, patched in version 4.97\n* Vendor: SafeLine\n* Problem type(s): CWE-305 Authentication bypass by primary weakness\n* CVE ID: CVE-2025-4994\n* CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-4994\n* CVSS 4.0 score: 8.7\n* Advisory URL: https://www.schutzwerk.com/blog/schutzwerk-sa-2025-001/\n\nDetails\n=======\n\n\ndepending on the \"Auto Enable BLE\" configuration setting:\n\n\n\u00a0 by a configurable PIN.\n\n\u00a0 enabled by a reboot.\n\n\nto the target device and is fully reproducible.\n\nRisk\n====\n\n\nan incident.\n\nWorkaround\n==========\n\n\ninterface.\n\nSolution/Mitigation\n===================\n\n\n\n\nshould be applied.\n\nTimeline\n========\n\n* 2025-03-28 Vulnerability discovered\n* 2025-04-14 Initial contact with vendor\n* 2025-04-16 Vulnerability reported to technical support of vendor\n* 2025-05-08 Follow-up meeting was canceled by vendor\n* 2025-05-16 Initial contact with CTO of vendor\n* 2025-05-28 Vulnerability presented to CTO of vendor\n* 2025-06-16 Vendor informed SCHUTZWERK that the patch is currently tested\n* 2025-07-03 Follow-up meeting was canceled by vendor\n* 2025-07-31 Follow-up meeting was requested by SCHUTZWERK\n* 2025-08-21 Vendor informed SCHUTZWERK that the patch was postponed\n* 2025-08-28 Vendor informed SCHUTZWERK that the patch is currently tested\n* 2025-12-19 Vendor informed SCHUTZWERK that the patch was released\n\n\u00a0 scheduled maintenance windows\n* 2026-06-19 Advisory released by SCHUTZWERK\n\nCredits\n=======\n\nThe vulnerability was discovered by Jan H\u00fcber of SCHUTZWERK GmbH\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmpLjrQaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLruNEA/+IiLtH9rqkwhZA3H0qWQp\nZ6xH/M7Som+OkCn/qgZ7khBKi2qsC0jdA7ePf/D3LY2VlgA9Y60fAETXarNj2X/y\nKgB80TjrPRwBhPhdZKxhn14DCPjLANGVYVDanfR0oQmRzZ8aEjb9No6G04nb+qCV\nu7c1aD5Hl0vJRI7AAgkHjz1etgsYm7MKkJYHxhCuJFw2B4XpPjk9TREgofdC3FLk\nVkO5xMRUysMy9Sgy8qzesSySX5UHKoPVtndo/EVvDsUJccsIL6WdE4z4odMJ9cRE\nr8CX6LAnyhfktgDf8eOgzysfdkYl//0KO1IIGF8ghLqRDpgWkMZTHc2/GXPnPYL1\n3uIXI7vG8jGJ99fIijocplug9BAnQnK+w7PBJOzroWMOQC7zJWwy6gL2H/vYIatp\nFQFlgF5DnMBdjWX80Gu5CIDPYIVlXW15k7TNF/k5XUW3Uh6/uk8FTLgzPFsR707j\nXsWPKk7XICiizJDv2su8rmTtCpPtgHhC0HUoJa6eVBj+37l4EuPS0jpYEByfkmNY\ne+eka/F0kF4FzxAp2jWfE4A+QLlP6GGgZSLlfybVgvsjUe468intIDHaR9CPlv74\nDtLWZ3zr4OXTare4hm7F0dLN80WAG3A6ELsrqGknaKvD4ePaSBLdkL8q9tKZIQL5\nMUv9NZtj3B224OsNyt8EhjA=\n=JAMF\n-----END PGP SIGNATURE-----\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "CWE-305",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/17"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4994"
        },
        {
          "url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2025-001/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2025-001: Authentication Bypass for SafeLine SL6 and SL6+",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0064",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/17",
            "automated": true,
            "contentSha256": "bc6c342cc53996cd7d0cca6d5aaabd93c68cf21047b68bdfb4e82668635ad803",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-06T11:24:41Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0064"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0063

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[KIS-2026-16] Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation Vulnerability
Summary
------------------------------------------------------------------------------- Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation Vulnerability ------------------------------------------------------------------------------- [-] Software Link: https://www.teleniasoftware.com [-] Affected Versions: Version 26.5.3 and prior 26.x versions. Version 24.9.21 and prior 24.x versions. Older versions may be affected as well. [-] Vulnerability Description: The vulnerability is caused by an insecure sudoers configuration in the /etc/sudoers.d/telenia file: apache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id apache ALL=NOPASSWD: /usr/sbin/postsuper apache ALL=NOPASSWD: /bin/nice apache ALL=NOPASSWD: /usr/bin/hostnamectl apache ALL=NOPASSWD: /sbin/halt apache ALL=NOPASSWD: /sbin/reboot The apache user is allowed to execute the "nice" command with root privileges without requiring a password. Since "nice" can be abused to invoke arbitrary commands, this misconfiguration enables an attacker with access to the apache account to execute arbitrary commands as the root user, resulting in a Local Privilege Escalation. [-] Proof of Concept: https://karmainsecurity.com/pocs/tvox_root_rce.php [-] Solution: No official solution is currently available. [-] Disclosure Timeline: [22/05/2026] - Vendor was contacted, no response [27/05/2026] - Vendor was notified about this vulnerability, no response [27/05/2026] - Vendor was notified about 60-day disclosure deadline policy, no response [26/06/2026] - Vendor was contacted again along with CSIRT Italy, no response from CSIRT [08/07/2026] - First vendor response, asking for vulnerability details [09/07/2026] - Vulnerability details safely provided to the vendor [20/07/2026] - Vendor was contacted again, asking for an update [21/07/2026] - Vendor replied a security patch will be released by the end of July [21/07/2026] - CVE identifier requested [21/07/2026] - CVE identifier assigned [27/07/2026] - Reached 60-day disclosure deadline, still no official solution [03/08/2026] - Public disclosure [-] CVE Reference: CVE-2026-64829 has been assigned to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2026-16 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Egidio Romano
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation\nVulnerability\n-------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerability is caused by an insecure sudoers configuration in the\n/etc/sudoers.d/telenia file:\n\n\napache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id\n\napache ALL=NOPASSWD: /usr/sbin/postsuper\n\napache ALL=NOPASSWD: /bin/nice\napache ALL=NOPASSWD: /usr/bin/hostnamectl\napache ALL=NOPASSWD: /sbin/halt\napache ALL=NOPASSWD: /sbin/reboot\n\n\nThe apache user is allowed to execute the \"nice\" command with root\nprivileges without requiring a password. Since \"nice\" can be abused to\ninvoke arbitrary commands, this misconfiguration enables an attacker with\naccess to the apache account to execute arbitrary commands as the root\nuser, resulting in a Local Privilege Escalation.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[27/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64829 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-16\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/32"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-16"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/32"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-16] Telenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0063",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32",
            "automated": true,
            "contentSha256": "6fe3bdfe6e52b71acd1d426aa72052689d91f1538bde6a1175e9fab3479a1984",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/32",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:30:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0063"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0062

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[KIS-2026-15] Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection Vulnerability
Summary
------------------------------------------------------------------------------------- Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection Vulnerability ------------------------------------------------------------------------------------- [-] Software Link: https://www.teleniasoftware.com [-] Affected Versions: Version 26.5.3 and prior 26.x versions. Version 24.9.21 and prior 24.x versions. Older versions may be affected as well. [-] Vulnerability Description: The vulnerable code is located within the /opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script: 180. case "checkProcess": 181. $pid = @trim($_REQUEST["pid"]); 182. $logFile = @trim($_REQUEST["logFile"]); 183. if ($pid != "") 184. exec('ps -p ' . $_REQUEST["pid"], $output); User input passed through the "pid" request parameter (when the "action" request parameter is set to "checkProcess") is not properly sanitized before being used to execute OS commands via an exec() call at line 184. This can be exploited to inject and execute arbitrary OS commands with the privileges of the "apache" user on the web server. [-] Proof of Concept: https://karmainsecurity.com/pocs/tvox_root_rce.php [-] Solution: No official solution is currently available. [-] Disclosure Timeline: [22/05/2026] - Vendor was contacted, no response [26/05/2026] - Vendor was notified about this vulnerability, no response [27/05/2026] - Vendor was notified about 60-day disclosure deadline policy, no response [26/06/2026] - Vendor was contacted again along with CSIRT Italy, no response from CSIRT [08/07/2026] - First vendor response, asking for vulnerability details [09/07/2026] - Vulnerability details safely provided to the vendor [20/07/2026] - Vendor was contacted again, asking for an update [21/07/2026] - Vendor replied a security patch will be released by the end of July [21/07/2026] - CVE identifier requested [21/07/2026] - CVE identifier assigned [27/07/2026] - Reached 60-day disclosure deadline, still no official solution [03/08/2026] - Public disclosure [-] CVE Reference: CVE-2026-64828 has been assigned to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2026-15 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Egidio Romano
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection\nVulnerability\n-------------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:\n\n180.    case \"checkProcess\":\n181.        $pid = @trim($_REQUEST[\"pid\"]);\n182.        $logFile = @trim($_REQUEST[\"logFile\"]);\n183.        if ($pid != \"\")\n184.            exec(\u0027ps -p \u0027 . $_REQUEST[\"pid\"], $output);\n\nUser input passed through the \"pid\" request parameter (when the \"action\"\nrequest parameter is set to \"checkProcess\") is not properly sanitized\nbefore being used to execute OS commands via an exec() call at line 184.\nThis can be exploited to inject and execute arbitrary OS commands with the\nprivileges of the \"apache\" user on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64828 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-15\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/31"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-15"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/31"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-15] Telenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0062",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31",
            "automated": true,
            "contentSha256": "750a1c9853cbaf029db7a8361d781a98c8c41779467bc804c2ba737e24db81ff",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/31",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:29:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0062"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
displaying 371 - 380 publications in total 387