Michael Tsai

**Name of the Vulnerable Software and Affected Versions** FarCry Core framework versions prior to 7.2.14 **Description** The issue allows attackers to access sensitive information in the "/facade" directory. **Recommendations** For versions prior to 7.2.14, update to version 7.2.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FarCry Core framework versions prior to 7.2.14 **Description** The issue allows attackers to execute arbitrary code via uploading a crafted .cfm file to the /fileupload/upload.cfm endpoint. **Recommendations** For versions prior to 7.2.14, update to version 7.2.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the /fileupload/upload.cfm endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Dragonfly gem versions prior to 1.4.0 **Description** An argument injection issue allows remote attackers to read and write to arbitrary files via a crafted URL when the `verify url` option is disabled, potentially leading to code execution. This occurs because the generate and process features mishandle the use of the ImageMagick convert utility. **Recommendations** For Dragonfly gem versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider enabling the `verify url` option to minimize the risk of exploitation. Restrict access to the generate and process features until the update is applied.

Name of the Vulnerable Software and Affected Versions: symbiote/silverstripe-queuedjobs module versions 3 through 4 Description: A Cross Site Scripting issue allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL. This is achieved by exploiting the `CreateQueuedJobTask` dev task. Recommendations: For versions 3 through 4, consider disabling the `CreateQueuedJobTask` dev task until a patch is available to prevent exploitation. Restrict access to the dev task to minimize the risk of arbitrary payload injection.