Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload

Exploit Title: Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload Date: 12/20/2020 Exploit Author: Ramón Vila Ferreres @ramonvfer Vendor Homepage: https://contactform7.com Software Link: https://wordpress.org/plugins/contact-form-7/ Version: 5.3.1 and below Tested on: Windows 10 190...

WordPress Contact Form 7 5.3.1 Shell Upload

Exploit Title: Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload Date: 12/20/2020 Exploit Author: Ramón Vila Ferreres @ramonvfer Vendor Homepage: https://contactform7.com Software Link: https://wordpress.org/plugins/contact-form-7/ Version: 5.3.1 and below Tested on: Windows 10 190...

Resin < 4.0.40 Incorrect Unicode Transformations

The version of Resin installed on the remote host perform incorrect Unicode transformations on output to HTTP responses for ISO-8859-1. This allows an attacker to bypass filtering/encoding/validation done prior to the output transformation. Note that the scanner has not tested for these issues bu...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

Contact Form 7 < 5.3.2 - Unrestricted File Upload

The popular WordPress plugin, Contact Form 7 was found to be vulnerable to Unrestricted File Upload. Append a unicode special character from U+0000 null to U+001F us to a filename and upload it via the ContactForm7 upload feature...

LY Corporation: DoS of LINE client for Android via message containing multiple unicode characters (0x0e & 0x0f)

Due to an improper Unicode character processing, the recipient's LINE client for Android may terminate abnormally when an attacker sends large quantities of unicode characters 0x0e and 0x0f characters and the recipient opens the message containing them...

NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0074)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after- free. We are aware of targeted attack...

Hotfix XS81E002 - For Citrix Hypervisor 8.1

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.1. Note: Ensure that you use XenCenter 8.1.2 or later to install this hotfix. The latest version of XenCenter is available from theCitrix Hypervisor Download site. Information About this Hotfix Component|...

MISSIONS — The Next Level of Interactive Developer Security Training

If organizations want to get serious about software security, they need to empower their engineers to play a defensive role against cyberattacks as they craft their code. The problem is, developers haven't had the most inspiring introduction to security training over the years, and anything that...

MISSIONS — The Next Level of Interactive Developer Security Training

If organizations want to get serious about software security, they need to empower their engineers to play a defensive role against cyberattacks as they craft their code. The problem is, developers haven't had the most inspiring introduction to security training over the years, and anything that...

RHEL 7 : podman (RHSA-2020:5056)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5056 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use contain...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact

A buffer overflow flaw was found in the unicodetoansicopy function of unixODBC. This overflow is not directly controllable by an attacker making the maximum potential impact a crash or denial of service...

Moderate: Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RHEL 8 : container-tools:rhel8 (RHSA-2020:4694)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4694 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes:...

new module: perl:5.30

An update is available for perl-Pod-Perldoc, perl-DBI, perl-Pod-Escapes, perl-Devel-PPPort, perl-Pod-Usage, perl-Sub-Exporter, perl-perlfaq, perl-Object-HashBase, perl-CPAN-Meta-YAML, perl-Digest, perl-podlators, perl-bignum, perl-Text-ParseWords, perl-Text-Template, perl-DBD-MySQL, perl-Text-Glo...

Amazon Linux AMI : golang (ALAS-2020-1436)

The version of golang installed on the remote host is prior to 1.13.15-1.59. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1436 advisory. The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...