tree-chtsec

# -*- coding: UTF-8 -*-
import enum, os, sys
# https://twitter.com/highsenburger69
from ctypes.wintypes import *
from ctypes import *
# These libraries have the APIs we need
kernel32 = WinDLL('kernel32',  use_last_error=True)
advapi32 = WinDLL('advapi32',  use_last_error=True)
shell32  = WinDLL('shell32',   use_last_error=True)
psapi    = WinDLL('psapi.dll', use_last_error=True)

tree-chtsec

> [Suggested description]
> BlogEngine.NET 3.3.8.0 allow an editor to create any folder with "files" prefix under ~/App_Data/, 
> related to BlogEngine/BlogEngine.NET/AppCode/Api/FileManagerController.cs.
> 
> ------------------------------------------
> 
> [Vulnerability Type]
> Improper Input Validation
> 
> ------------------------------------------

tree-chtsec

> [Suggested description]
> BlogEngine.NET 3.3.8.0 allow an administrator to create account with arbitrary name, 
> attacker can then upload a crafted PNG to achieve remote code execution, related to BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs.
> 
> ------------------------------------------
> 
> [Vulnerability Type]
> Directory Traversal
> 
> ------------------------------------------