Eli Biham

**Name of the Vulnerable Software and Affected Versions** Totally Integrated Automation Portal (TIA Portal) versions V14 through V20 **Description** The issue is related to a flaw in the know-how protection feature of the affected products, which does not properly update the encryption of existing program blocks when a project file is updated. This could allow attackers with access to the project file to recover previous, yet unprotected, versions of the project without the knowledge of the know-how protection password. **Recommendations** For Totally Integrated Automation Portal (TIA Portal) versions V14 through V20, consider restricting access to project files to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid updating project files that contain sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.0.1 iOS (affected versions not specified) **Description** A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. A person with physical access to an iOS device may be able to access contacts from the lock screen. **Recommendations** For macOS Big Sur, update to version 11.0.1 or later to resolve the issue. For iOS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.4 **Description** A logic issue was addressed with improved state management, which could allow a local user to view sensitive user information. **Recommendations** For versions prior to 10.15.4, update to macOS Catalina 10.15.4 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.13 iOS versions prior to 11.4 Android versions prior to the 2018-06-05 patch Description: The issue is related to incorrect validation of cryptographic signatures in Bluetooth drivers for Android, macOS, and iOS operating systems. This can allow an attacker to perform a "man-in-the-middle" attack. The vulnerability is due to insufficient validation of elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device. Recommendations: For macOS versions prior to 10.13, update to version 10.13 or later. For iOS versions prior to 11.4, update to version 11.4 or later. For Android versions prior to the 2018-06-05 patch, apply the 2018-06-05 patch or later.