Yu Wang

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to errors in handling input data in the Core component of the Oracle WebLogic Server. It allows an unauthenticated attacker with network access via T3 to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0, update to a version that includes the fix for this issue. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the T3 protocol to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3, IIOP to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. It is estimated that millions of servers worldwide are affected, with 166,000 in Brazil alone. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0, update to a version that includes the fix released by Oracle on January 24. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix released by Oracle on January 24. As a temporary workaround, consider restricting access to the T3 and IIOP protocols to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.0.1 macOS Big Sur versions prior to 11.6.2 macOS Catalina versions prior to Security Update 2021-008 **Description** A logic issue was addressed with improved validation. A malicious application may be able to disclose kernel memory. **Recommendations** For macOS versions prior to 12.0.1, update to macOS Monterey 12.0.1. For macOS Big Sur versions prior to 11.6.2, update to macOS Big Sur 11.6.2. For macOS Catalina versions prior to Security Update 2021-008, apply Security Update 2021-008.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.1 macOS Big Sur versions prior to 11.6.2 macOS Catalina versions prior to Security Update 2021-008 **Description** A race condition issue was addressed with improved locking, which could allow a remote attacker to cause unexpected application termination or heap corruption. **Recommendations** For macOS versions prior to 12.1, update to macOS Monterey 12.1 or later. For macOS Big Sur versions prior to 11.6.2, update to macOS Big Sur 11.6.2 or later. For macOS Catalina versions prior to Security Update 2021-008, apply Security Update 2021-008 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.0.1 macOS Big Sur versions prior to 11.6.1 Security Update versions prior to 2021-007 Catalina **Description** A race condition was addressed with improved state handling, which may allow a malicious application to execute arbitrary code with kernel privileges. The issue is related to a Bluetooth component vulnerability in the macOS operating system, caused by concurrent execution using a shared resource with incorrect synchronization. **Recommendations** For macOS versions prior to 12.0.1, update to macOS Monterey 12.0.1 or later. For macOS Big Sur versions prior to 11.6.1, update to macOS Big Sur 11.6.1 or later. For Security Update versions prior to 2021-007 Catalina, apply Security Update 2021-007 Catalina or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Big Sur 11.4 Security Update versions prior to 2021-003 on Catalina Security Update versions prior to 2021-004 on Mojave **Description** A logic issue was addressed with improved state management, which may allow a remote attacker to cause unexpected application termination or arbitrary code execution. **Recommendations** For macOS versions prior to Big Sur 11.4, update to macOS Big Sur 11.4 or later. For Catalina, apply Security Update 2021-003 or later. For Mojave, apply Security Update 2021-004 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server version 12.1.3.0.0 **Description** The issue is related to insufficient access control in the Core Components of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. **Recommendations** For version 12.1.3.0.0, consider restricting access to the IIOP and T3 protocols as a temporary workaround until a patch is available. Additionally, review and implement proper access control measures to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave **Description** An out-of-bounds read issue existed, leading to the disclosure of kernel memory. This issue was addressed with improved input validation. A local user may be able to cause unexpected system termination or read kernel memory. **Recommendations** For macOS versions prior to Big Sur 11.1, update to macOS Big Sur 11.1 or later. For macOS Catalina, apply Security Update 2020-001. For macOS Mojave, apply Security Update 2020-007.

**Name of the Vulnerable Software and Affected Versions** tvOS versions prior to 14.0 iOS versions prior to 14.0 iPadOS versions prior to 14.0 **Description** A logic issue was addressed with improved state management, allowing an application to potentially execute arbitrary code with kernel privileges. **Recommendations** For tvOS versions prior to 14.0, update to tvOS 14.0 to resolve the issue. For iOS versions prior to 14.0, update to iOS 14.0 to resolve the issue. For iPadOS versions prior to 14.0, update to iPadOS 14.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.1 macOS Big Sur version 11.0.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave **Description** A memory corruption issue was addressed with improved input validation. A malicious application may be able to execute arbitrary code with system privileges. **Recommendations** For macOS Big Sur versions prior to 11.1, update to macOS Big Sur 11.1. For macOS Big Sur version 11.0.1, update to macOS Big Sur 11.1. For Security Update 2020-001 Catalina, apply Security Update 2020-001 Catalina. For Security Update 2020-007 Mojave, apply Security Update 2020-007 Mojave.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.1 macOS Big Sur version 11.0.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave **Description** A memory corruption issue was addressed with improved input validation. A malicious application may be able to execute arbitrary code with system privileges. **Recommendations** For macOS Big Sur versions prior to 11.1, update to macOS Big Sur 11.1. For macOS Big Sur version 11.0.1, update to macOS Big Sur 11.1. For Security Update 2020-001 Catalina, apply Security Update 2020-001 Catalina. For Security Update 2020-007 Mojave, apply Security Update 2020-007 Mojave.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to a vulnerability in the Oracle WebLogic Server product, specifically in the Console component. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server, potentially resulting in a takeover. The vulnerability is easily exploitable and can impact the confidentiality, integrity, and availability of the server. It is associated with errors in code generation management and can be exploited using HTTP requests. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the emergency patch released by Oracle to fix this critical flaw. As a temporary workaround, consider restricting access to the Console component until a patch is applied. Avoid using the vulnerable Console component in the affected Oracle WebLogic Server versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.6 **Description** A memory corruption issue was addressed with improved input validation, allowing an application to potentially execute arbitrary code with kernel privileges. **Recommendations** For versions prior to 10.15.6, update to macOS Catalina 10.15.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.4 **Description** An out-of-bounds read issue was addressed with improved input validation. A local user may be able to cause unexpected system termination or read kernel memory. **Recommendations** For versions prior to 10.15.4, update to macOS Catalina 10.15.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.4 **Description** A memory corruption issue was addressed with improved validation. A malicious application may be able to determine kernel memory layout. **Recommendations** For versions prior to 10.15.4, update to macOS Catalina 10.15.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.6 **Description** A memory corruption issue was addressed with improved memory handling, which could allow a local user to cause unexpected system termination or read kernel memory. **Recommendations** For versions prior to 10.15.6, update to macOS Catalina 10.15.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.6 **Description** The issue involves multiple memory corruption problems that have been resolved through enhanced memory handling. An application could potentially execute arbitrary code with kernel privileges. **Recommendations** For macOS versions prior to 10.15.6, update to macOS Catalina 10.15.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Oracle WebLogic Server, allowing a remote attacker to execute arbitrary code via the IIOP protocol. This can result in the takeover of the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider disabling the IIOP protocol until a patch is available to prevent exploitation. As a temporary workaround, restrict access to the Core component of the Oracle WebLogic Server to minimize the risk of exploitation. Avoid using the IIOP protocol in the affected Oracle WebLogic Server versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MySQL Server versions 8.0.21 and prior **Description** The issue is related to insufficient input validation in the MySQL Server product, specifically in the Server: DML component. This allows a high-privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks can result in the takeover of the MySQL Server or cause a hang or frequently repeatable crash (complete DOS) of the server. **Recommendations** For versions 8.0.21 and prior, update to a version that contains a fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.5 **Description** An out-of-bounds read issue was addressed with improved bounds checking. A malicious application may be able to determine kernel memory layout. **Recommendations** For versions prior to 10.15.5, update to macOS Catalina 10.15.5 to resolve the issue.