CVE-2022-0404

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7mddismissnotice action, allowing any logged in user with roles as low as Subscriber to set...

CVE-2022-0404

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7mddismissnotice action, allowing any logged in user with roles as low as Subscriber to set...

CVE-2022-0404 Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7mddismissnotice action, allowing any logged in user with roles as low as Subscriber to set...

CVE-2022-0404

The CVE-2022-0404 issue affects the Material Design for Contact Form 7 WordPress plugin (versions ≤ 2.6.4). The root cause is missing authorization checks in the cf7md_dismiss_notice handling, allowing any logged‑in user (even Subscriber) to set arbitrary plugin options to true, potentially causi...

PT-2022-13158 · WordPress · Contact Form 7 Material Design

Name of the Vulnerable Software and Affected Versions: Material Design for Contact Form 7 WordPress plugin versions 2.6.4 and earlier Description: The issue allows any logged-in user, even those with low roles such as Subscriber, to set arbitrary options to true due to a lack of authorization...

WordPress plugin Material Design for Contact Form安全漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Material Design for Contact Form plugin suffers from a denial of service vulnerability that stems from a plugin validatio...

retail-material.demo.proximity.page Cross Site Scripting vulnerability OBB-2439847

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS

The plugin does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7mddismissnotice action, allowing any logged in user with roles as low as Subscriber to set arbitrary options to true, potentially leading to Denial of...

WordPress Material Design for Contact Form 7 plugin <= 2.6.4 - Arbitrary Settings Update vulnerability leading to Denial of Service (DoS)

Arbitrary Settings Update vulnerability leading to Denial of Service DoS discovered by Krzysztof Zając in WordPress Material Design for Contact Form 7 plugin versions = 2.6.4. Solution Deactivate and delete. This plugin has been closed as of February 11, 2022 and is not available for download. Th...

Samsung Encryption Flaw

Researchers have found a major encryption flaw in 100 million Samsung Galaxy phones. From the abstract: In this work, we expose the cryptographic design and implementation of Androids Hardware-Backed Keystore in Samsungs Galaxy S8, S9, S10, S20, and S21 flagship devices. We reversed-engineered an...

WordPress Material Design for Contact Form 7 plugin <= 2.6.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Material Design for Contact Form 7 plugin versions = 2.6.4. Solution No patched version available...

WordPress Material Design for Contact Form 7 plugin <= 2.6.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Material Design for Contact Form 7 plugin versions = 2.6.4. Solution No patched version available...

GSD-2022-1000069 Hardware glitching attack in Trezor One Hardware Wallet version Unknown

The Trezor Hardware Wallet One based on the ARM Cortex-M3-based STM32 F2 uses the RDP2 security level by default in SDP2 RAM cannot be copied, but the security can be downgraded to RDP1 where the contents of memory can be copied via glitch injection during device power on. Please note although th...

Mageia: Security Advisory (MGASA-2013-0382)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of Adobe Premiere Rush software, related to the execution of operations beyond buffer boundaries in memory, allows attackers to execute arbitrary code.

The vulnerability of Adobe Premiere Rush is related to the execution of operations beyond the buffer in memory when processing MXF files. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-2-1161

2.1161 Notification on the update of the Red OS OPERATION SYSTEM MIS Due to quality improvement and bug fixing, an updated version of the "RED OS" Operating System "RED OS" 7.3 is released. You can contact the technical support service within the framework of your existing technical support...

CVE-2021-40757

Adobe After Effects version 18.4.1 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a...

CVE-2021-43575

KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similar issue to CVE-2021-36799. NOTE: The vendor disputes this because it is not the responsibility of the ETS to securely store cryptographic...

CVE-2021-43575

KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similar issue to CVE-2021-36799. NOTE: The vendor disputes this because it is not the responsibility of the ETS to securely store cryptographic...

Adobe Xmp Toolkit 代码问题漏洞

Adobe Xmp Toolkit is a toolkit from Adobe USA, Inc. It is used to integrate Xmp functionality into a product or solution. A code issue vulnerability exists in Adobe XMP Toolkit 2020.1 and prior versions, which stems from a null pointer dereference issue in the software. The vulnerability could...