Ryan Pickren

The issue is related to an uncontrolled resource consumption in the WebKit component of the visionOS operating system. Exploitation of this issue may allow a remote attacker to inject arbitrary 3D objects and cause a denial-of-service. Processing web content may lead to a denial-of-service. The issue was addressed with improvements to the file handling protocol.

A CORS misconfiguration in the web-based management allows a malicious third-party web server to misuse basic information pages, potentially leading to the disclosure of device information such as CPU diagnostics. The impact is limited to a small subset of confidentiality due to the restricted amount of readable information.

The issue is related to the lack of authentication for a critical function in the web-based management interface, allowing an unauthenticated attacker to access and modify device parameters. This could lead to the full compromise of the device. The vulnerability may also allow a remote attacker to execute arbitrary code.

The issue is related to the lack of authentication for a critical function in the configuration backend of the software. This could allow a remote attacker to write arbitrary data with root privileges, potentially leading to unauthenticated remote code execution and full system compromise.

The configuration backend of the web-based management interface for WAGO programmable logic controllers and touch panels is vulnerable to reflected Cross-Site Scripting (XSS) attacks. This vulnerability can be exploited by a remote attacker to conduct inter-site script attacks, potentially affecting the confidentiality and integrity of the system, but with no impact on availability.

A logic issue was addressed with improved state management, allowing a malicious application to bypass Gatekeeper checks. This issue affects the Safari browser.

A malicious OSAX scripting addition may bypass Gatekeeper checks and circumvent sandbox restrictions. This issue was addressed by disabling execution of JavaScript when viewing a scripting dictionary.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.3 iPadOS versions prior to 14.3 Description: A logic issue was addressed with improved state management. The issue causes an enterprise application installation prompt to display the wrong domain. Recommendations: For iOS versions prior to 14.3, update to iOS 14.3 or later to resolve the issue. For iPadOS versions prior to 14.3, update to iPadOS 14.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.4 iPadOS versions prior to 14.4 Description: A lock screen issue allowed unauthorized access to contacts on a locked device. This was possible due to inadequate state management. An attacker with physical access to the device could potentially view private contact information. Recommendations: For iOS versions prior to 14.4, update to iOS 14.4 or later to resolve the issue. For iPadOS versions prior to 14.4, update to iPadOS 14.4 or later to resolve the issue.

A logic issue was addressed with improved validation. The issue involves a URL scheme that may be incorrectly ignored when determining multimedia permission for a website.

A logic issue was addressed with improved restrictions. Some websites may not have appeared in Safari Preferences.

An input validation issue was addressed with improved input validation. Processing maliciously crafted web content may lead to a cross site scripting attack.

The issue is related to input validation and may lead to a cross-site scripting attack when processing maliciously crafted web content. This can allow a remote attacker to perform inter-site script attacks by exploiting the vulnerability in the WebKit modules for displaying web pages.

A logic issue was addressed with improved restrictions. A malicious iframe may use another website's download settings.

A logic issue was addressed with improved restrictions. The issue is related to incorrect association of a download's origin. Exploitation of this issue may allow a remote attacker to impact the integrity of protected information.

The issue is related to an incorrect implementation of control flow, which may allow a remote attacker to compromise the integrity of protected information due to incorrect processing of a file URL.

The issue is related to multiple memory corruption problems that have been addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution.

A logic issue was addressed with improved validation. The issue involves a DOM object context that may not have had a unique security origin, potentially allowing attackers to affect the system.

A permissions issue existed in the handling of motion and orientation data, allowing a website to access sensor information without user consent. This issue was addressed with improved restrictions.

A logic issue was addressed with improved validation. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting.