OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...

CVE-1999-1301

The CVE-1999-1301 issue concerns the rzsz implementation of the Z-Modem protocol in FreeBSD prior to 2.1.5. A design flaw in the Z-Modem handling allows the remote sender of a file to execute arbitrary programs on the client, constituting remote code execution at the client side. Affected compone...