Raphael Vinot

Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora

Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb

Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding

Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture