Andreas Kurtz

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9.1 **Description** The issue is related to the Telephony subsystem in Apple iOS, which lacks protection for certain internal data. This can be exploited by a remote attacker using a specially crafted app to gain access to information about completed calls. **Recommendations** For versions prior to 9.1, update to version 9.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9 **Description** The issue allows physically proximate attackers to obtain sensitive information more easily. This is due to CFNetwork relying on the hardware UID for its cache encryption key. **Recommendations** For versions prior to 9, update to iOS version 9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9 **Description** The issue is related to a lack of protection for system data in the CoreAnimation component of the iOS operating system. This can be exploited by a remote attacker using a specially crafted background application to gain access to the clipboard. The exploitation allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access. **Recommendations** For Apple iOS versions prior to 9, update to a version 9 or later to resolve the issue. As a temporary workaround, consider restricting the use of background applications to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 8.3 **Description** The issue allows attackers to read sensitive information, including the telephone number or e-mail address of a recent contact, via a crafted app. This is related to the Sandbox Profiles component. **Recommendations** For versions prior to 8.3, update to version 8.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 8.3 **Description** The issue allows attackers to bypass a sandbox protection mechanism and access unintended telephone capabilities via a crafted app. **Recommendations** For versions prior to 8.3, update to version 8.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 7 **Description** The issue concerns the generation of default Wi-Fi passwords in Apple iOS. Specifically, the WifiPasswordController generateDefaultPassword method relies on the UITextChecker suggestWordInLanguage method for selecting Wi-Fi hotspot WPA2 PSK passphrases. This approach results in an insufficient number of possible passphrases, making it easier for remote attackers to obtain access via a brute-force attack. **Recommendations** For Apple iOS versions prior to 7, consider changing the default Wi-Fi password to a stronger, manually generated passphrase to minimize the risk of exploitation. As a temporary workaround, restrict access to sensitive data and networks until a secure password can be set.

**Name of the Vulnerable Software and Affected Versions** Openfire versions 3.6.0a and earlier **Description** A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `url` parameter in the login.jsp file of the Admin Console. **Recommendations** For Openfire versions 3.6.0a and earlier, update to a version later than 3.6.0a to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Openfire versions 3.6.0a and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `type` parameter in the "sipark-log-summary.jsp" endpoint. **Recommendations** For Openfire versions 3.6.0a and earlier, update to a version later than 3.6.0a to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Openfire versions 3.6.0a and earlier **Description** A directory traversal issue in the AuthCheck filter of the Admin Console allows remote attackers to bypass authentication and access the admin interface by including a .. (dot dot) in a URI. This can be achieved by crafting a specific URI sequence, such as /setup/setup-/.., which matches the Exclude-Strings list. **Recommendations** For Openfire versions 3.6.0a and earlier, consider restricting access to the Admin Console until a fix is available. As a temporary workaround, disabling the AuthCheck filter may prevent exploitation, but this should be done with caution as it may have unintended consequences on the security of the Admin Console. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Openfire versions 3.6.0a and earlier **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the `url` parameter in the login.jsp file. **Recommendations** For Openfire versions 3.6.0a and earlier, consider restricting access to the login.jsp file until a patch is available. As a temporary workaround, avoid using the `url` parameter in the login.jsp file to minimize the risk of exploitation.