Jake Mccallum

**Name of the Vulnerable Software and Affected Versions** mojoPortal versions 2.9.0.1 and earlier **Description** The issue allows an attacker to perform a Directory Traversal attack via the BetterImageGallery API Controller, specifically through the `ImageHandler` action. This can lead to unauthorized access to sensitive files, such as the Web.Config file, potentially exposing the MachineKey. **Recommendations** For versions 2.9.0.1 and earlier, consider restricting access to the BetterImageGallery API Controller, specifically the `ImageHandler` action, until a patch is available. As a temporary workaround, limit the exposure of sensitive files like the Web.Config file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BlogEngine.Net version 3.3.8.0 **Description** A Cross-Site Request Forgery (CSRF) issue allows unauthenticated attackers to read arbitrary files on the hosting web server. **Recommendations** For BlogEngine.Net version 3.3.8.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** BlogEngine.NET version 3.3.8.0 **Description** The issue allows attackers to delete files within the web server root directory via a crafted HTTP request. This is an arbitrary file deletion vulnerability. **Recommendations** For BlogEngine.NET version 3.3.8.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.