CVE-2023-22518

CVE-2023-22518 Exploit für Confluence CVE-2023-22518 Backup-Wiederherstellungs-RCE Endpunkt POST /setup/setup-restore.action Erfordert gültige Anmeldung und Admin-Rechte oder einen Authentifizierungs-Bypass Dateien xmlexport-20231127-071916-1.zip – leeres Confluence-Backup. Das Wiederherstellen...

CVE-2025-43537

CVE-2025-43537 Credito di Sicurezza Apple Ricercatore: Al Sadman Awal Accreditato ufficialmente da Apple Product Security per la divulgazione responsabile di CVE-2025-43537. Panoramica CVE-2025-43537 è una vulnerabilità di sicurezza identificata durante una ricerca di sicurezza indipendente e...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 Referenzen Hut ab vor den Profis: Blog des Autors der CVE-2023-50386-Schwachstelle Java-Security-Manager-Bypass-Techniken Reflexionsschutz-Bypass unter JDK 17 JNI-Bypass gegen RASP Ausnutzungsprinzip und...

CVE-2024-44258

CVE-2024-44258: Symlink-Schwachstelle im ManagedConfiguration-Framework Zusammenfassung CVE-2024-44258 hebt eine Symlink-Schwachstelle im ManagedConfiguration-Framework und dem profiled-Daemon auf Apple-Geräten hervor. Beim Wiederherstellen eines manipulierten Backups wird im Migrationsprozess...

CVE-2022-30075

CVE-2022-30075 Authentifizierte Remote-Codeausführung in Tp-Link-Routern Betroffene Geräte Wenn Ihr Tp-Link-Router über eine Backup- und Wiederherstellungsfunktion verfügt und die Firmware älter als Juni 2022 ist, ist er wahrscheinlich anfällig Getestet mit Tp-Link Archer AX50, andere...

reload.sh

reload.sh Non farlo... Per favore non farlo su sistemi live es. produzione o sul tuo computer personale dove hai memorizzato dati critici. Questa ricetta ti mostra come installare un sistema nuovo dove un altro sistema esiste ed è in esecuzione. È davvero figo e sorprendente, ma molto rischioso! ...

Emlog 2.1.9 - SQL Injection

emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files. id: CVE-2023-39121 info: name: Emlog 2.1.9 - SQL Injection author: wjch611 severity: high description: |...

CVE-2026-55168

CVE-2026-55168 Este repositório contém um PoC simples para CVE-2026-55168 no Runtipi. O problema é uma escrita arbitrária de ficheiro autenticada que pode ser alcançada através do fluxo de restauro de backup. Um arquivo de backup malicioso pode plantar um symlink nos dados restaurados da aplicaçã...

CVE-2023-33781

CVE-2023-33781 Descrizione È stato scoperto che D-Link DIR-842V2 v1.0.3 permette a un utente di eseguire un binario arbitrario quando si connette via telnet. Questa vulnerabilità può essere attivata utilizzando la funzionalità di backup/ripristino. Prova di concetto...

CVE-2023-5808

CVE-2023-5808 CVE-2023-5808 एक असुरक्षित प्रत्यक्ष वस्तु संदर्भ IDOR भेद्यता है जो हिताची NAS HNAS के सिस्टम प्रबंधन इकाई SMU बैकअप और पुनर्स्थापना कार्यक्षमता में पाई गई है। यह भेद्यता SMU के 14.8.7825.01 से पहले के संस्करणों को प्रभावित करती है। शोषण इस शोषण के लिए हमलावर को ऐसे उपयोगकर्ता खाते...

SparstanBoogie

SparstanBoogie’s Ursprünge wurden Berichten zufolge auf iOS/iPadOS 15.2 – 16.7 RC 20H18 und 17.0 getestet, allerdings wurden Tests bis zu 26.1 26.1 sind. Auch Tests auf Geräten oberhalb oder unterhalb der gemeldeten Versionen sind willkommen, da es auf neueren Geräten möglicherweise wieder...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore: Symlink Path Traversal → RCE CVSS 8.4 Critico · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 In breve Un attaccante autenticato admin carica un tar di backup appositamente modificato. Il percorso di ripristino estrae il homeassistant.tar.gz interno co...

CVE-2026-55168

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

EUVD-2026-64143

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168

Runtipi (personal homeserver orchestrator) versions 4.10.0 and earlier are vulnerable to an authenticated arbitrary file write via symlink planting during the backup restore flow. An attacker with valid credentials can craft a backup archive containing a symlink (e.g., user-config/app.env pointin...

NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

GHSA-J2G6-362Q-6QC6 Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...

Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...