Josh

The issue allowed users to bypass the Lock WARP switch feature on the WARP iOS mobile client. This was possible by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches simultaneously in the application settings, causing the WARP client to disconnect. As a result, users could bypass restrictions and policies enforced by the Zero Trust platform.

The Lock Warp switch feature in the Zero Trust platform can be bypassed due to insufficient policy verification by the WARP iOS client. This bypass can be achieved by using the "Disable WARP" quick action, allowing users of enrolled devices to disable the WARP client even when the Lock Warp switch is enabled.

The issue allowed a user to delete a VPN profile from the WARP mobile client on the iOS platform, despite the Lock WARP switch feature being enabled on the Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.

The issue allows a user to disconnect the WARP client and bypass the "Lock WARP switch" feature by using the warp-cli command "add-trusted-ssid". This results in Zero Trust policies not being enforced on an affected endpoint.

An SQL injection issue affects WooCommerce sites running the WooCommerce Blocks feature plugin. This can be exploited via a carefully crafted URL against the "wc/store/products/collection-data?calculate attribute counts[][taxonomy]" endpoint, allowing the execution of a read-only SQL query.

An SQL injection issue affects WooCommerce sites running the plugin between versions 3.3.0 and 3.3.5. Malicious actors with admin access or API keys can exploit vulnerable endpoints such as "/wp-json/wc/v3/webhooks" and "/wp-json/wc/v2/webhooks". By carefully crafting the `search` parameter, information can be disclosed using timing and related attacks, although data will not be returned directly.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `file` parameter in a "view file" action.