CentOS 7 : firefox (RHSA-2023:1333)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1333 advisory. - Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a...

Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations < 5.0.6.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins. Visit the following path on the site as an admin user:...

Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard < 2.11.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins. Visit the following path on the site as an admin user:...

Oracle Linux 7 : firefox (ELSA-2023-1333)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-1333 advisory. 102.9.0-3.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs....

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2023-12207)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12207 advisory. - ipv6: raw: Deduct extension header length in rawv6pushpendingframes Herbert Xu Orabug: 35005829 CVE-2023-0394 - net: sched: disallow noqueue for...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2023-12206)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12206 advisory. - ipv6: raw: Deduct extension header length in rawv6pushpendingframes Herbert Xu Orabug: 35005829 CVE-2023-0394 - net: sched: disallow noqueue for...

RHEL 7 : firefox (RHSA-2023:1333)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1333 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2023-12200)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-12200 advisory. - ipv6: raw: Deduct extension header length in rawv6pushpendingframes Herbert Xu Orabug: 35005830 CVE-2023-0394 - net: sched: disallow noqueue for qdi...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2023-12199)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12199 advisory. - ipv6: raw: Deduct extension header length in rawv6pushpendingframes Herbert Xu Orabug: 35005830 CVE-2023-0394 - net: sched: disallow noqueue for qdi...

Google Uncovers 18 Severe Security Vulnerabilities in Samsung Exynos Chips

Google is calling attention to a set of severe security flaws in Samsung's Exynos chips, some of which could be exploited remotely to completely compromise a phone without requiring any user interaction. The 18 zero-day vulnerabilities affect a wide range of Android smartphones from Samsung, Vivo...

WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contact Form 7 – PayPal & Stripe Add-on Type Plugin Vulnerable versions = 1.9.3 Fixed in 1.9.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-24405 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 071c0edcb7eb...

CVE-2023-28371

In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal...

March 14, 2023—KB5023759 (Security-only update)

None None...

March 14, 2023—KB5023769 (Monthly Rollup)

None None...

Admin side data storage for Contact Form 7 <= 1.1.1 - Unauthenticated Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Admin side data storage for Contact Form 7 Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24420 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID dcc5858412a7...

CVE-2022-47166

CVE-2022-47166 : CSRF vulnerability in the WordPress plugin “Void Contact Form 7 Widget For Elementor Page Builder” (versions ≤ 2.1.1). Root cause: Cross-Site Request Forgery in the plugin’s handling of user requests. Impact: potentially allows unauthorized actions within the application (per cit...

CVE-2022-47166 WordPress Void Contact Form 7 Widget For Elementor Page Builder Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin = 2.1.1 versions...

WordPress Real Estate 7 Theme <= 3.3.4 is vulnerable to Broken Access Control

Software Real Estate 7 Type Theme Vulnerable versions = 3.3.4 Fixed in 3.3.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 5.8 Developer Claim ownership PSID a71c4c5edd92 Credits RE-ALTER Required privilege Unauthenticat...

7.cz Cross Site Scripting vulnerability OBB-3219187

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...