David Kierznowski

**Name of the Vulnerable Software and Affected Versions** curl and libcurl versions 5.11 through 7.19.3 **Description** The issue allows remote HTTP servers to trigger arbitrary requests to intranet servers, read or overwrite arbitrary files via a redirect to a file: URL, or execute arbitrary commands via a redirect to an scp: URL, when CURLOPT FOLLOWLOCATION is enabled. This can be exploited to expose local files, upload files to unauthorized locations, or execute commands on the server. The problem can also be used to access files on remote servers if credentials are stored in the .netrc file or if an unencrypted SSH key is available. **Recommendations** For curl and libcurl versions 5.11 through 7.19.3, consider disabling the CURLOPT FOLLOWLOCATION option to prevent automatic redirects until a patch is available. As a temporary workaround, restrict access to sensitive local files and avoid using the `Location` header with untrusted servers. Avoid using the `scp` protocol with libcurl until the issue is resolved. If possible, update to a version later than 7.19.3 to fully resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Persits XUpload version 3.0.0.4 and earlier **Description** The issue is related to a stack-based buffer overflow in the Persits.XUpload.2 ActiveX control. This occurs when a long argument is passed to the `AddFile` method, allowing remote attackers to execute arbitrary code. **Recommendations** For Persits XUpload version 3.0.0.4 and earlier, consider disabling the `AddFile` method until a patch is available to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: FeedBurner FeedSmith plugin for WordPress version 2.2 Description: A cross-site request forgery (CSRF) issue allows remote attackers to change settings and hijack blog feeds. This is achieved by submitting parameter values to FeedBurner FeedSmith Plugin.php via a request to "wp-admin/options-general.php". The vulnerable parameters include `feedburner url` and `feedburner comments url`. Recommendations: For FeedBurner FeedSmith plugin for WordPress version 2.2, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the "wp-admin/options-general.php" endpoint to minimize the risk of unauthorized setting changes. Avoid using the `feedburner url` and `feedburner comments url` parameters in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WordPress version 2.0.5 Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `file` parameter in `wp-admin/templates.php`. Some sources report this as related to the `get file description` function in `wp-admin/admin-functions.php`. Recommendations: For WordPress version 2.0.5, update to a newer version to mitigate the risk, as the specific fix for this issue is not detailed in the provided information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sage version 1.3.6 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via JavaScript in a `content:encoded` element within an `item` element in an RSS feed. This can be used to read arbitrary local files, as demonstrated by example `content:encoded` elements that utilize `XMLHttpRequest`. **Recommendations** For Sage version 1.3.6, consider disabling the processing of JavaScript within `content:encoded` elements in RSS feeds as a temporary workaround until a patch is available. Restrict access to sensitive local files to minimize the risk of exploitation.