Heige

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 15.3 iPadOS versions prior to 15.3 watchOS versions prior to 8.4 tvOS versions prior to 15.3 Safari versions prior to 15.3 macOS Monterey versions prior to 12.2 **Description** A validation issue was addressed with improved input sanitization. Processing a maliciously crafted mail message may lead to running arbitrary javascript. The issue is related to insufficient input validation, which can be exploited by a remote attacker to impact data integrity. **Recommendations** For iOS versions prior to 15.3, update to iOS 15.3 or later. For iPadOS versions prior to 15.3, update to iPadOS 15.3 or later. For watchOS versions prior to 8.4, update to watchOS 8.4 or later. For tvOS versions prior to 15.3, update to tvOS 15.3 or later. For Safari versions prior to 15.3, update to Safari 15.3 or later. For macOS Monterey versions prior to 12.2, update to macOS Monterey 12.2 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Jet Red Database Engine and Access Connectivity Engine (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Microsoft Jet Red Database Engine and Access Connectivity Engine of Microsoft Windows operating systems. It allows a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.0.1 **Description** An access issue was addressed with improved access restrictions. Processing a maliciously crafted document may lead to a cross site scripting attack. **Recommendations** For versions prior to 11.0.1, update to macOS Big Sur 11.0.1 to resolve the issue. As a temporary workaround, consider avoiding the processing of maliciously crafted documents until the update is applied.

Name of the Vulnerable Software and Affected Versions: Windows Jet Database Engine (affected versions not specified) Description: A remote code execution issue exists due to the improper handling of objects in memory by the Windows Jet Database Engine. This could allow an attacker to execute arbitrary code on a victim system by enticing the victim to open a specially crafted file. The issue is also described as a buffer overflow vulnerability in the Microsoft JET Database Engine. The vulnerability enables remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12.5 **Description** The issue involves the `iBooks` component and allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app. **Recommendations** For macOS versions prior to 10.12.5, update to version 10.12.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OS X versions prior to 10.11.5 **Description** The issue is related to the Messages component mishandling filename encoding, allowing remote attackers to obtain sensitive information. The exploitation of this issue can lead to unauthorized access to confidential data. **Recommendations** For OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions prior to 2.3.20 **Description** The issue is related to the ParametersInterceptor in Apache Struts, which does not properly restrict access to the getClass method. This allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request. The vulnerability exists due to an incomplete fix for a previous issue. It is related to the implementation of the getClass method, which has access control deficiencies when using the ParametersInterceptor with the class parameter. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted request. **Recommendations** For Apache Struts versions prior to 2.3.20, update to version 2.3.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the `getClass()` method via the ParametersInterceptor to minimize the risk of exploitation. Restrict access to the `class` parameter in the affected API endpoint to prevent manipulation of the ClassLoader.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions prior to 2.3.20 **Description** The issue is related to the CookieInterceptor in Apache Struts, where an incomplete fix for a previous issue has led to a vulnerability. This vulnerability allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request, due to insufficient access restrictions when handling wildcard cookiesName values. The exploitation requires the application to be configured to accept all cookies, allowing access to the class parameter directly mapped to the getClass() method. **Recommendations** For Apache Struts versions prior to 2.3.20, update to version 2.3.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the getClass method in the CookieInterceptor class until a patch is available. Avoid using wildcard values for the cookiesName parameter in the CookieInterceptor to minimize the risk of exploitation.