32253 matches found
RHEL 7 : rh-mariadb105-galera and rh-mariadb105-mariadb (RHSA-2023:7633)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7633 advisory. MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. The...
WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49766 Patch priority High CVSS severity High 7.1 Developer Themefic PSID faa03e459da6 Credits RE-ALTER Required...
CVE-2023-6449
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7antiscriptfilename' function in versions up to, and including, 5.8.3. This makes it possible for...
Input validation
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7antiscriptfilename' function in versions up to, and including, 5.8.3. This makes it possible for...
CVE-2023-6449 Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7antiscriptfilename' function in versions up to, and including, 5.8.3. This makes it possible for...
CVE-2023-6449
The CVE-2023-6449 entry concerns the WordPress plugin Contact Form 7, versions up to and including 5.8.3. The flaw is an arbitrary file upload vulnerability caused by insufficient file-type validation in validate and weak blocklisting in wpcf7_antiscript_file_name. Authenticated attackers with ed...
CVE-2023-6449 Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7antiscriptfilename' function in versions up to, and including, 5.8.3. This makes it possible for...
CVE-2023-6449 Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7antiscriptfilename' function in versions up to, and including, 5.8.3. This makes it possible for...
Contact Form 7 < 5.8.4 - Authenticated (Editor+) Arbitrary File Upload
Description The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7antiscriptfilename' function in versions up to, and including, 5.8.3. This makes it possible f...
PT-2023-32670 · WordPress · Contact Form 7
Name of the Vulnerable Software and Affected Versions: Contact Form 7 versions up to, and including, 5.8.3 Description: The issue arises from insufficient file type validation in the validate function and insufficient blocklisting on the wpcf7 antiscript file name function. This allows...
WordPress Contact Form 7 Plugin <= 5.8.3 is vulnerable to Arbitrary File Upload
Software Contact Form 7 Type Plugin Vulnerable versions = 5.8.3 Fixed in 5.8.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6449 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 21a488c2a64b Credits István Márton Required privilege Editor...
WordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Software Track Geolocation Of Users Using Contact Form 7 Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49188 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1322772c72f4 Credits DoYeon Par...
RHEL 7 : squid (RHSA-2023:7576)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7576 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: Denial of...
RHEL 7 : squid (RHSA-2023:7578)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7578 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: Denial of...
Oracle Linux 7 : firefox (ELSA-2023-7509)
The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-7509 advisory. 115.5.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs....
Oracle Linux 7 : thunderbird (ELSA-2023-7505)
The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-7505 advisory. 115.5.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 115.5.0-1 - Update to...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 7 security fixes: 1491459 High CVE-2023-6348: Type Confusion in Spellcheck. Reported by Mark Brand of Google Project Zero on 2023-10-10 1494461 High CVE-2023-6347: Use after free in Mojo. Reported by Leecraso and Guang Gong of 360 Vulnerability Resear...
AZL-34576 CVE-2023-42365 affecting package busybox for versions less than 1.36.1-7
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function...
AZL-34575 CVE-2023-42364 affecting package busybox for versions less than 1.36.1-7
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function...