Chris Peterson

**Name of the Vulnerable Software and Affected Versions** Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation versions prior to 2.8.8 **Description** An issue exists where unauthenticated attackers can perform Server-Side Request Forgery (SSRF), a flaw that allows a server to be coerced into making requests to an unintended location. This can be used to query or modify information from internal services. The issue occurs via the `upload attachment` function. Exploitation requires a form integration to be configured with a field mapped to a WooCommerce product image, product gallery, downloadable files, or Google Contacts attachment field. **Recommendations** Update to a version newer than 2.8.7.

**Name of the Vulnerable Software and Affected Versions** CF7 to Webhook versions prior to 5.0.1 **Description** The CF7 to Webhook plugin for WordPress is subject to Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server-side application to make requests to an unintended location. This occurs via the `pull the trigger` function. Unauthenticated attackers can make web requests to arbitrary locations from the web application to query or modify information from internal services. Exploitation is possible if the admin-configured webhook URL contains a Contact Form 7 field placeholder in the host segment of the URL and the affected form is publicly accessible. **Recommendations** Update the plugin to a version later than 5.0.0.

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 141 Description: Firefox for Android displayed URLs in the address bar by truncating the end of the URL instead of prioritizing the origin, potentially misleading users about the actual website they are visiting. Recommendations: Update Firefox for Android to version 141 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 118 Firefox ESR versions prior to 115.3 Thunderbird versions prior to 115.3 **Description** The issue is related to memory safety bugs, which have shown evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is also described as a buffer overflow in memory, which could allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 118, update to version 118 or later. For Firefox ESR versions prior to 115.3, update to version 115.3 or later. For Thunderbird versions prior to 115.3, update to version 115.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 110.1.0 **Description** The issue is related to a use-after-free vulnerability in the libaudio library of Mozilla Firefox for Android. This vulnerability can be exploited by a remote attacker using a specially crafted web page, potentially allowing the execution of arbitrary code. The vulnerability is caused by the use of memory after it has been freed. **Recommendations** For Firefox for Android versions prior to 110.1.0, update to version 110.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the AAudio backend when running on Android API below version 30 to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 91 **Description** The issue is related to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. It is associated with memory safety bugs that showed evidence of memory corruption, which could potentially be exploited. **Recommendations** For versions prior to 91, update to version 91 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 53 Firefox ESR versions prior to 45.9 Firefox ESR versions prior to 52.1 Thunderbird versions prior to 52.1 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 53, update to version 53 or later. For Firefox ESR versions prior to 45.9, update to version 45.9 or later. For Firefox ESR versions prior to 52.1, update to version 52.1 or later. For Thunderbird versions prior to 52.1, update to version 52.1 or later.