Full Disclosure A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.
- [0day-rubbish] TRENDnet TV-IP302PI firmware 1.02.38 authenticated NTP server-address OS command injection to root command execution via a shell-form system() call (7.2 High, PR:H)
on October 20, 2026 at 6:50 pmPosted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in TRENDnet TV-IP302PI firmware 1.02.38, the closed-source IP surveillance camera from TRENDnet (United States). The camera’s application daemon is shipped at /hunt/hunt_server: an ARM 32-bit EABI5 version 5TE soft-float binary, dynamically linked against /lib/ld-linux.so.3, 4.5 MB and stripped. Its own string pool carries hunt_camera, HuntAudioConverter, HuntDataDirect and…
- [0day-rubbish] Royal Render 9.1.26b: default-unauthenticated job submission on rrServer TCP 7773 reaches worker-side shell execution as the worker identity, measured root (8.1 High)on October 20, 2026 at 6:50 pm
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in Royal Render 9.1.26b, the closed-source render-farm job manager for VFX and animation studios from Binary Alchemy (proprietor Holger Schoenberger) of Ludwigsburg, Germany. Royal Render is a different product from the Royal Server gateway sold by Royal Apps GmbH of Austria; the two are unrelated companies sharing one word in their names, and this disclosure concerns the German…
- [0day-rubbish] ProSoft Technology RLX-IFH24E v2.2.44 unsigned firmware upgrade package to root command execution and full account-database overwrite (7.2)on October 20, 2026 at 6:50 pm
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in the ProSoft RLX-IFH24E, version v2.2.44, the industrial wireless radio from ProSoft Technology, Inc. (United States). The appliance is a closed-source embedded device and an OEM build of the MicroHard Systems IPx21 platform on the MHX-910 board design: an Intel IXP425 XScale processor, ARM big-endian, Linux 2.4.24-uc0, with static management pages under /usr/web and 57 ARM…
- [0day-rubbish] Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT anonymous deserialization in the database restore path to JSP command execution as uid=1000 (9.8)on October 20, 2026 at 6:50 pm
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT, the closed-source commercial continuous-testing, service-virtualisation and environment-management product from Parasoft, a United States software-testing vendor headquartered in Monrovia, California. The affected component is the em web application inside the vendor’s own container image, running on Tomcat 10.1.57 with…
- [0day-rubbish] Exasol Database 7.1.30 docker-db form: shipped default SYS credential to PYTHON3 UDF os.popen command execution as uid=500(exadefusr), output returned in-band (8.8)on October 20, 2026 at 6:50 pm
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in Exasol Database 7.1.30, the in-memory MPP analytical database from Exasol AG (Germany), examined in its docker-db single-container deployment form. The SQL engine is a proprietary C implementation named EXASolution, the server process is exacts, clients speak a proprietary binary SQL protocol on port 8563 rather than HTTP, TLS terminates on that port with a self-signed…
- [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the setWAN WAN-configuration handler, root command execution (7.2)on October 20, 2026 at 6:50 pm
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in the Edimax BR-6478AC, firmware image BR6478AC_v2.20.bin, the dual-band AC1750 SOHO wireless router from Edimax Technology Co., Ltd. (Taiwan). A single authenticated POST that looks like an ordinary WAN settings submission reaches system() with a request-controlled username interpolated unquoted into a shell command line, behind a sanitiser that inspects exactly one character,…
- [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the formWlanMP manufacturing-test handler, root command execution (7.2)on October 20, 2026 at 6:49 pm
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in the Edimax BR-6478AC, firmware image BR6478AC_v2.20.bin, the dual-band AC1750 SOHO wireless router from Edimax Technology Co., Ltd. (Taiwan). A single authenticated POST to a manufacturing radio-calibration route that is still registered in production firmware reaches system() with thirty raw request fields interpolated into one command line, and the web server process that…
- [ROOTEDCON] Call for Papers 2027 · RootedCON2027 (Madrid)on October 20, 2026 at 6:49 pm
Posted by Román Ramírez on Oct 20-=] About RootedCON RootedCON is a technology and cybersecurity conference that will take place in Madrid (Spain) from March 4 to 6, 2027. This will be our XVII EDITION! With an attendance of between 9,000 and 10,000 people, it is the most relevant specialized conference in the country and one of the most important in Europe. We welcome students, Security Forces and Corps, technology and information security professionals, and, above all,…
- VestaCP root RCE (VESTACP-2026-001)on October 15, 2026 at 7:43 am
Posted by Bryan Ramirez via Fulldisclosure on Oct 15Advisory ID: VESTACP-2026-001 / GHSA-m2mc-xwq7-pw72 Product: Vesta Control Panel (VestaCP) Versions: <= 0.9.8-26 (unmaintained since 2019-09; no upstream fix exists) Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9 CWE: CWE-78 (OS Command Injection), CWE-95 (Eval Injection) Reporter: Bryan Ramirez – SYSDOP LLC <security () sysdop com> SUMMARY ——- VestaCP stores per-account…
- [SYSS-2026-080]: dcm4che – Path Traversal (CWE-22)on October 15, 2026 at 7:43 am
Posted by Matthias Deeg via Fulldisclosure on Oct 15Advisory ID: SYSS-2026-080 Product: dcm4che Manufacturer: J4Care Affected Version(s): 5.35.0 Tested Version(s): 5.35.0 Vulnerability Type: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-08-06 Public Disclosure: 2026-10-13 CVE Reference: Not yet…
- [SYSS-2026-079]: dcm4che – Path Traversal (CWE-22)on October 15, 2026 at 7:43 am
Posted by Matthias Deeg via Fulldisclosure on Oct 15Advisory ID: SYSS-2026-079 Product: dcm4che Manufacturer: J4Care Affected Version(s): 5.35.0 Tested Version(s): 5.35.0 Vulnerability Type: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-08-06 Public Disclosure: 2026-10-13 CVE…
- [SYSS-2026-078]: dcm4che – Path Traversal (CWE-22)on October 15, 2026 at 7:43 am
Posted by Matthias Deeg via Fulldisclosure on Oct 15Advisory ID: SYSS-2026-078 Product: dcm4che Manufacturer: J4Care Affected Version(s): 5.35.0 Tested Version(s): 5.35.0 Vulnerability Type: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-08-06 Public Disclosure: 2026-10-13 CVE…
- [SYSS-2026-077]: dcm4che – Path Traversal (CWE-22)on October 15, 2026 at 7:43 am
Posted by Matthias Deeg via Fulldisclosure on Oct 15Advisory ID: SYSS-2026-077 Product: dcm4che Manufacturer: J4Care Affected Version(s): 5.35.0 Tested Version(s): 5.35.0 Vulnerability Type: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-08-06 Public Disclosure: 2026-10-13 CVE…
- [0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5)on October 15, 2026 at 7:42 am
Posted by disclosure via Fulldisclosure on Oct 150day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics Syncrify 6.2 build 1178, the closed-source incremental backup and file-replication server from Synametrics Technologies, Inc. (United States). The product is written in Java, distributed for Linux as a tarball archive, and served by an embedded Tomcat 9.0.113 through the vendor’s in-house sradef framework, whose single front controller routes every request as…
- [0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\SYSTEM (8.1)on October 15, 2026 at 7:42 am
Posted by disclosure via Fulldisclosure on Oct 150day Rubbish Research Team is publicly disclosing a vulnerability chain in South River Technologies Titan MFT Server 26.0.0.364, the NextGen generation of the commercial managed file transfer server from South River Technologies (Annapolis, Maryland, United States). The product runs as a single .NET 8 process, titanmft.exe, registered as the Windows service SrtTitanMFTServerService under LocalSystem, serves a Blazor Server administration…
