Francois Harvey

**Name of the Vulnerable Software and Affected Versions** Copymatic – AI Content Writer & Generator versions 1.6 and earlier **Description** The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the Copymatic – AI Content Writer & Generator. This allows for the upload of files with potentially dangerous types, posing a risk. **Recommendations** For Copymatic – AI Content Writer & Generator versions 1.6 and earlier, consider restricting file uploads to only allow safe file types until a patch is available. As a temporary workaround, disabling the file upload feature can help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Solid Affiliate versions 1.9.1 and earlier **Description** The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. **Recommendations** For Solid Affiliate versions 1.9.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Asterisk@Home versions prior to 2.8 **Description** The issue allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the `recording` parameter in the Asterisk Recording Interface (ARI) web interface. This can also be used to determine the existence of files. **Recommendations** For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the recordings/misc/audio.php file to minimize the risk of exploitation. Avoid using the `recording` parameter with full pathnames in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Barracuda Spam Firewall versions 3.1.16 through 3.1.17 **Description** The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the `f` parameter in the img.pl file. **Recommendations** For versions 3.1.16 and 3.1.17, avoid using the `f` parameter in the img.pl file until a fix is available. As a temporary workaround, consider restricting access to the img.pl file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Barracuda Spam Firewall versions 3.1.16 through 3.1.17 **Description** A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. (dot dot) in the `f` parameter of the img.pl file. **Recommendations** For versions 3.1.16 and 3.1.17, consider restricting access to the img.pl file until a patch is available. As a temporary workaround, avoid using the `f` parameter in the img.pl file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Barracuda Spam Firewall versions 3.1.16 through 3.1.17 **Description** The issue allows remote attackers to read portions of source code via the -f option to `dig device.cgi`, determine file existence via the -r argument to `tcpdump device.cgi`, or modify files in the cgi-bin directory via the -w argument to `tcpdump device.cgi`. **Recommendations** For versions 3.1.16 and 3.1.17, consider restricting access to the `dig device.cgi` and `tcpdump device.cgi` scripts until a patch is available. As a temporary workaround, avoid using the -f option with `dig device.cgi`, the -r argument with `tcpdump device.cgi`, and the -w argument with `tcpdump device.cgi` to minimize the risk of exploitation.