Chris Peterson

The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull the trigger. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the admin-configured webhook URL contains a Contact Form 7 field placeholder in the host segment of the URL, and that the affected form is publicly accessible.

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 141 Description: Firefox for Android displayed URLs in the address bar by truncating the end of the URL instead of prioritizing the origin, potentially misleading users about the actual website they are visiting. Recommendations: Update Firefox for Android to version 141 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 118 Firefox ESR versions prior to 115.3 Thunderbird versions prior to 115.3 **Description** The issue is related to memory safety bugs, which have shown evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is also described as a buffer overflow in memory, which could allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 118, update to version 118 or later. For Firefox ESR versions prior to 115.3, update to version 115.3 or later. For Thunderbird versions prior to 115.3, update to version 115.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 110.1.0 **Description** The issue is related to a use-after-free vulnerability in the libaudio library of Mozilla Firefox for Android. This vulnerability can be exploited by a remote attacker using a specially crafted web page, potentially allowing the execution of arbitrary code. The vulnerability is caused by the use of memory after it has been freed. **Recommendations** For Firefox for Android versions prior to 110.1.0, update to version 110.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the AAudio backend when running on Android API below version 30 to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 91 **Description** The issue is related to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. It is associated with memory safety bugs that showed evidence of memory corruption, which could potentially be exploited. **Recommendations** For versions prior to 91, update to version 91 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 53 Firefox ESR versions prior to 45.9 Firefox ESR versions prior to 52.1 Thunderbird versions prior to 52.1 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 53, update to version 53 or later. For Firefox ESR versions prior to 45.9, update to version 45.9 or later. For Firefox ESR versions prior to 52.1, update to version 52.1 or later. For Thunderbird versions prior to 52.1, update to version 52.1 or later.