Kağan Eğlence

**Name of the Vulnerable Software and Affected Versions** Apple tvOS versions prior to 15.4 Apple iOS versions prior to 15.4 Apple iPadOS versions prior to 15.4 **Description** An out-of-bounds write issue was addressed with improved bounds checking, which may allow an application to execute arbitrary code with kernel privileges. **Recommendations** For tvOS versions prior to 15.4, update to tvOS 15.4 or later. For iOS versions prior to 15.4, update to iOS 15.4 or later. For iPadOS versions prior to 15.4, update to iPadOS 15.4 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 15.4 iPadOS versions prior to 15.4 **Description** The GSMA authentication panel could be presented on the lock screen, allowing a person with physical access to view and modify the carrier account information and settings. This issue was resolved by requiring device unlock to interact with the GSMA authentication panel. **Recommendations** For iOS versions prior to 15.4, update to iOS 15.4 or later to resolve the issue. For iPadOS versions prior to 15.4, update to iPadOS 15.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** UliCMS versions 2019.1 through 2019.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `go` parameter to `admin/index.php`, the `go` parameter to `/admin/index.php?register=register`, or the `error` parameter to `admin/index.php?action=favicon`. **Recommendations** For UliCMS version 2019.1, update to a version that contains a fix for this issue. For UliCMS version 2019.2, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `admin/index.php` and `/admin/index.php?register=register` endpoints to minimize the risk of exploitation. Avoid using the `go` and `error` parameters in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** HumHub version 1.3.12 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a "POST request to /protected/vendor/codeception/codeception/tests/data/app/view/index.php". **Recommendations** For HumHub version 1.3.12, as a temporary workaround, consider restricting access to the /protected/vendor/codeception/codeception/tests/data/app/view/index.php endpoint until a patch is available.