Lovasoa

**Name of the Vulnerable Software and Affected Versions** CAPTCHA Protected Page versions 0.0.0 through 1.0.2 **Description** An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to sufficiently validate its CAPTCHA verification cookies, enabling an unauthenticated user or automated bot to forge the cookie and bypass the verification process entirely. **Recommendations** Update CAPTCHA Protected Page to a version newer than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** SQLpage versions prior to 0.11.1 **Description** SQLpage is a SQL-only webapp builder. An attacker can retrieve database connection information from SQLpage and use it to connect to the database directly if the SQLpage instance is exposed publicly, the database connection string is specified in the `sqlpage/sqlpage.json` configuration file, the web root is the current working directory, and the database is exposed publicly. **Recommendations** For SQLpage versions prior to 0.11.1, upgrade to version 0.11.1 as soon as possible. As a temporary workaround, consider using an environment variable instead of the configuration file to specify the database connection string. Using a different web root that is not a parent of the SQLPage configuration directory fixes the issue. Avoid exposing the database publicly.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 13.6 Apple iPadOS versions prior to 13.6 Apple tvOS versions prior to 13.4.8 Apple watchOS versions prior to 6.2.8 Apple Safari versions prior to 13.1.2 Apple iTunes for Windows versions prior to 12.10.8 Apple iCloud for Windows versions prior to 11.3 and 7.20 **Description** A command injection issue existed in Web Inspector due to insufficient escaping. Copying a URL from Web Inspector may lead to command injection. This issue was addressed with improved escaping. **Recommendations** For iOS versions prior to 13.6, update to iOS 13.6 or later. For iPadOS versions prior to 13.6, update to iPadOS 13.6 or later. For tvOS versions prior to 13.4.8, update to tvOS 13.4.8 or later. For watchOS versions prior to 6.2.8, update to watchOS 6.2.8 or later. For Safari versions prior to 13.1.2, update to Safari 13.1.2 or later. For iTunes for Windows versions prior to 12.10.8, update to iTunes 12.10.8 or later. For iCloud for Windows versions prior to 11.3 and 7.20, update to iCloud for Windows 11.3 or 7.20 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 83.0.4103.61 **Description** The issue is related to an inappropriate implementation in developer tools, allowing a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page. This can happen if the attacker convinces the user to take certain actions in the developer tools. The exploitation of this issue may allow the attacker to access confidential data. **Recommendations** For versions prior to 83.0.4103.61, update to version 83.0.4103.61 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 81.0.4044.92 **Description** The issue is related to insufficient data validation in developer tools, allowing a remote attacker to execute arbitrary code via a crafted HTML page if the user is convinced to use devtools. This could potentially lead to access to confidential data, disruption of data integrity, and denial of service. **Recommendations** For versions prior to 81.0.4044.92, update to version 81.0.4044.92 or later to resolve the issue.