Xqc2000

**Name of the Vulnerable Software and Affected Versions** HTTL versions through 1.0.11 **Description** The issue allows remote command execution due to the unsafe use of XStream in the decodeXml function when configured with an xml.codec=httl.spi.codecs.XstreamCodec setting. **Recommendations** For versions through 1.0.11, consider disabling the decodeXml function or avoiding the use of the XstreamCodec setting until a patch is available. Restrict access to the affected function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HTTL versions through 1.0.11 **Description** The issue allows remote command execution due to the unsafe use of java.beans.XMLEncoder by the decodeXml function when configured without an xml.codec setting. **Recommendations** For versions through 1.0.11, consider configuring the xml.codec setting to prevent the unsafe use of java.beans.XMLEncoder until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Smarty versions prior to 3.1.33-dev-4 **Description** The issue is related to a flaw in the processing of the $trusted dir array, which is part of the trusted directory protection mechanism. This flaw can be exploited by attackers to bypass the protection and gain unauthorized access to sensitive information. The exploitation involves using a `file:./../` substring in an include statement, allowing access to files outside the intended directory. For example, an attacker could use the `file:./../../../../../etc/passwd` path to access sensitive system files. **Recommendations** For versions prior to 3.1.33-dev-4, update to version 3.1.33-dev-4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the include statement with the `file:./../` substring to minimize the risk of exploitation. Additionally, review and limit access to sensitive files and directories to prevent unauthorized access.