Arjun Basnet from Securin

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

system() after failed chdir()

SQL injection in MySQL CNID backend

Stack buffer overflow via UCS-2 type confusion in convert_charset()

Out-of-bounds write in convert_charset() null termination

Heap buffer overflow in CNID daemon comm_rcv()

Arbitrary file read via attacker-controlled symlink creation

Weak cryptography in DHCAST128 UAM

Bitwise OR logic bug enables shell injection

Authentication bypass via admin auth user