Name	SBA Research Cookie
Provider	SBA Research
Purpose	Saves the settings of the visitors selected in the cookie box.
Cookie name	sba-research-cookie
Cookie runtime	1 year

Name	YouTube
Provider	YouTube
Purpose	Used to unblock YouTube content.
Privacy policy	https://policies.google.com/privacy
Host(s)	google.com
Cookie name	NID
Cookie runtime	6 months

Name	Vimeo
Provider	Vimeo
Purpose	Used to unblock Vimeo content.
Privacy policy	https://vimeo.com/privacy
Host(s)	player.vimeo.com
Cookie name	vuid
Cookie runtime	2 years

Successful Kick-off for the 1st Shecurity Summer School in Vienna!

September 29, 2025

From September 19 to 21, around 65 talented and curious women and FINTA* immersed themselves in the exciting world of cybersecurity at the University of Vienna. This continuing education and networking program is unique in Europe and is designed to make it easier to enter and advance in IT security. ... Read More

Successful Kick-off for the 1st Shecurity Summer School in Vienna!

ARES 2025

August 21, 2025

The 20th International Conference on Availability, Reliability, and Security (ARES 2025) took center stage in Ghent, Belgium, from August 11-14, 2025, offering a platform for experts and enthusiasts to explore the latest developments in the field. Co-located with ARES 2025 was the 8th International Symposium for Industrial Control System & SCADA Cyber Security Research.... Read More

ARES 2025 beach flag and a lot of bikes in front of university Ghent campus

Congratulations to KuK Hofhackerei – 9th Place at DEF CON CTF 33!

August 12, 2025

We are incredibly proud of the Austrian hacking team KuK Hofhackerei, which secured 9th place at DEF CON CTF 33, one of the toughest and most renowned Capture the Flag competitions in the world. The DEF CON Capture the Flag competition is… Read More

Congratulations to KuK Hofhackerei – 9th Place at DEF CON CTF 33!

SBA Security Advisory – Filebrowser Insecure Password Handling (CVE-2025-52997)

July 24, 2025

Vulnerability Overview All user accounts authenticate towards a Filebrowser instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process. Recommended Countermeasure We recommend to update to Filebrowser version 2.34.1 or later and configure… Read More

SBA Security Advisory – Filebrowser Password Protection of Links Bypassable (CVE-2025-52996)

July 24, 2025

Vulnerability Overview Files managed by Filebrowser can be shared with a link to external persons. While the application allows protecting those links with a password, the implementation is error-prone, making an incidental unprotected sharing of a file possible. Recommended Countermeasure We recommend to update to… Read More

SBA Security Advisory – Filebrowser Command Execution Allowlist Bypass (CVE-2025-52995)

July 24, 2025

Vulnerability Overview The Command Execution feature of Filebrowser only allows the execution of shell commands which have been predefined on a user-specific allowlist. The implementation of this allowlist is erroneous, allowing a user to execute additional commands not permitted. Recommended Countermeasure We recommend to update… Read More

SBA Security Advisory – Filebrowser Command Execution not Limited to Scope (CVE-2025-52904)

July 24, 2025

Vulnerability Overview In the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access… Read More

SBA Security Advisory – Filebrowser Shell Commands Can Spawn Other Commands (CVE-2025-52903)

July 24, 2025

Vulnerability Overview The Command Execution feature of Filebrowser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. Recommended Countermeasure We recommend to disable the… Read More

SBA Security Advisory – Filebrowser Sensitive Data Transferred in URL (CVE-2025-52901)

July 24, 2025

Vulnerability Overview URLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. Filebrowser violates this practice, since access tokens are used as GET parameters. Read More

Young Researchers´ Day @ ICT Security Conference 2025 – Recap

July 2, 2025

A group of dedicated young researchers presented their work at the 21st ICT Security Conference on 25 and 26 June 2025, which was organized by the Austrian Armed Forces. They impressed the audience with their… Read More

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Tag: GlanceBox

Successful Kick-off for the 1st Shecurity Summer School in Vienna!

ARES 2025

Congratulations to KuK Hofhackerei – 9th Place at DEF CON CTF 33!

SBA Security Advisory – Filebrowser Insecure Password Handling (CVE-2025-52997)

SBA Security Advisory – Filebrowser Password Protection of Links Bypassable (CVE-2025-52996)

SBA Security Advisory – Filebrowser Command Execution Allowlist Bypass (CVE-2025-52995)

SBA Security Advisory – Filebrowser Command Execution not Limited to Scope (CVE-2025-52904)

SBA Security Advisory – Filebrowser Shell Commands Can Spawn Other Commands (CVE-2025-52903)

SBA Security Advisory – Filebrowser Sensitive Data Transferred in URL (CVE-2025-52901)

Young Researchers´ Day @ ICT Security Conference 2025 – Recap

Upcoming events @ SBA

SBA Research at a glance

Highlights of the past years:

Privacy settings

SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Tag: GlanceBox

Highlights of the past years:

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.