Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in TRENDnet
TV-IP302PI firmware 1.02.38, the closed-source IP surveillance camera from
TRENDnet (United States). The camera's application daemon is shipped at
/hunt/hunt_server: an ARM 32-bit EABI5 version 5TE soft-float binary,
dynamically linked against /lib/ld-linux.so.3, 4.5 MB and stripped. Its own
string pool carries hunt_camera, HuntAudioConverter, HuntDataDirect and...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in Royal
Render 9.1.26b, the closed-source render-farm job manager for VFX and
animation studios from Binary Alchemy (proprietor Holger Schoenberger) of
Ludwigsburg, Germany. Royal Render
is a different product from the Royal Server gateway sold by Royal Apps GmbH
of Austria; the two are unrelated companies sharing one word in their names,
and this disclosure concerns the German...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in the
ProSoft RLX-IFH24E, version v2.2.44, the industrial wireless radio from
ProSoft Technology, Inc. (United States). The appliance is a closed-source
embedded device and an OEM build of the MicroHard Systems IPx21 platform on
the MHX-910 board design: an Intel IXP425 XScale processor, ARM
big-endian, Linux 2.4.24-uc0, with static management pages under /usr/web
and 57 ARM...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in Parasoft
Continuous Testing Platform 10.7.5-SNAPSHOT, the closed-source commercial
continuous-testing, service-virtualisation and environment-management product
from Parasoft, a United States software-testing vendor headquartered in
Monrovia, California. The affected component is the em web application inside
the vendor's own container image, running on Tomcat 10.1.57 with...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in Exasol
Database 7.1.30, the in-memory MPP analytical database from Exasol AG
(Germany), examined in its docker-db single-container deployment form. The SQL
engine is a proprietary C implementation named EXASolution, the server process
is exacts, clients speak a proprietary binary SQL protocol on port 8563 rather
than HTTP, TLS terminates on that port with a self-signed...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in the
Edimax BR-6478AC, firmware image BR6478AC_v2.20.bin, the dual-band AC1750 SOHO
wireless router from Edimax Technology Co., Ltd. (Taiwan). A single
authenticated POST that looks like an ordinary WAN settings submission reaches
system() with a request-controlled username interpolated unquoted into a shell
command line, behind a sanitiser that inspects exactly one character,...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in the
Edimax BR-6478AC, firmware image BR6478AC_v2.20.bin, the dual-band AC1750 SOHO
wireless router from Edimax Technology Co., Ltd. (Taiwan). A single
authenticated POST to a manufacturing radio-calibration route that is still
registered in production firmware reaches system() with thirty raw request
fields interpolated into one command line, and the web server process that...

Posted by Román Ramírez on Oct 20

-=] About RootedCON

RootedCON is a technology and cybersecurity conference that will take place in Madrid (Spain) from March 4 to 6, 2027.

This will be our XVII EDITION!

With an attendance of between 9,000 and 10,000 people, it is the most relevant specialized conference in the country
and one of the most important in Europe. We welcome students, Security Forces and Corps, technology and information
security professionals, and, above all,...

Posted by Bryan Ramirez via Fulldisclosure on Oct 15

Advisory ID: VESTACP-2026-001 / GHSA-m2mc-xwq7-pw72
Product: Vesta Control Panel (VestaCP)
Versions: <= 0.9.8-26 (unmaintained since 2019-09; no upstream fix exists)
Severity: Critical - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9
CWE: CWE-78 (OS Command Injection), CWE-95 (Eval Injection)
Reporter: Bryan Ramirez - SYSDOP LLC <security () sysdop com>

SUMMARY
-------
VestaCP stores per-account...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-080
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE Reference: Not yet...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-079
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory ('Path Traversal') (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-078
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory ('Path Traversal') (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-077
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory ('Path Traversal') (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics
Syncrify 6.2 build 1178, the closed-source incremental backup and
file-replication server from Synametrics Technologies, Inc. (United States). The
product is written in Java, distributed for Linux as a tarball archive, and
served by an embedded Tomcat 9.0.113 through the vendor's in-house sradef
framework, whose single front controller routes every request as...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability chain in South
River Technologies Titan MFT Server 26.0.0.364, the NextGen generation of the
commercial managed file transfer server from South River Technologies (Annapolis,
Maryland, United States). The product runs as a single .NET 8 process,
titanmft.exe, registered as the Windows service SrtTitanMFTServerService under
LocalSystem, serves a Blazor Server administration...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear
Collaborator Server 15.1.15101, the closed-source peer and technical code-review
platform from SmartBear that runs as a Java web application on Apache Tomcat. One
low-privilege authenticated account plants a Groovy Server Page in the Tomcat
webroot through an archive-extraction path traversal, and any anonymous client -
a crawler, a scanner, anyone - then executes it...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in PacsOne
Server 7.3.9, Premium Edition, Linux x86-64 distribution, the closed-source
commercial PACS (medical imaging archive and DICOM server) from RainbowFish
Software, California, United States. The product combines a native C++ DICOM
and HL7 service with a PHP web interface of 204 endpoints running on MySQL
and Apache, fronted by a single Apache alias that maps /pacsone to...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal
2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom),
oriented at PayPal checkout and distributed as a commercial closed-source archive,
verified end to end against a real installation of that version in three
independent reproductions.

Type: unrestricted upload of a file with a dangerous type (CWE-434 primary, with
CWE-94 and CWE-693...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Maian
Guardian 2.1, the self-hosted licensing system for PHP applications encoded
with SourceGuardian, distributed as a closed-source commercial PHP script by
Maian Script World (United Kingdom) and verified end to end against a real
installation of that version.

Type: OS command injection (CWE-78 primary; CWE-116, CWE-20 and CWE-561
contributing; CWE-250 and CWE-732 as...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo
Portal 26.2.8 together with Dataedo Agent 26.2.8, the closed-source enterprise
data-catalog and data-governance platform from Dataedo sp. z o.o. (Poland).
Both components are in scope because the chain crosses from one to the other:
the Portal discloses a database credential, and the separately installed Agent
executes an injected scheduler job on its own host. In the...