Ronnie Goodrich

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.4.1 WordPress versions 5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33 **Description** In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. The vulnerability is related to insufficient protection measures in the `formatting.php` and `SanitizeFileName.php` components, which can allow a remote attacker to impact data integrity. **Recommendations** For versions prior to 5.4.1, update to version 5.4.1 or later to resolve the issue. For versions 5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33, update to the respective minor release or later to resolve the issue. As a temporary workaround, consider restricting file uploads to trusted users until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** LibreOffice versions prior to 5.4.5 LibreOffice versions 6.x prior to 6.0.1 **Description** The issue is related to the COM.MICROSOFT.WEBSERVICE function in LibreOffice, which allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document. This is due to inadequate management of registration data. An attacker can exploit this issue by sending a specially crafted request to gain access to protected information. **Recommendations** For versions prior to 5.4.5, update to version 5.4.5 or later. For versions 6.x prior to 6.0.1, update to version 6.0.1 or later. As a temporary workaround, consider disabling the `COM.MICROSOFT.WEBSERVICE` function until a patch is available.