Blackcon

**Name of the Vulnerable Software and Affected Versions** container versions prior to 1.2.0 **Description** A malicious builder peer can request an in-context file by name from the host and obtain the contents of any file the name resolves to, including files located outside the build context. **Recommendations** Update to version 1.2.0.

**Name of the Vulnerable Software and Affected Versions** JS JOBS FREE extension for Joomla! versions prior to 1.2.7 **Description** The issue allows SQL Injection via the "index.php?option=com jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo" API endpoint, specifically through the `child` parameter in the `models/custormfields.php` file. This could potentially lead to unauthorized access to database information. **Recommendations** For JS JOBS FREE extension versions prior to 1.2.7, update to version 1.2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the `index.php?option=com jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo` API endpoint until the update is applied. Avoid using the `child` parameter in the affected endpoint until the issue is resolved.