David Gullasch

**Nome do software vulnerável e versões afetadas** Versões do Safari anteriores à 15 Versões do macOS anteriores à 12.0.1 Versões do iOS anteriores à 14.8 Versões do iPadOS anteriores à 14.8 Versões do tvOS anteriores à 15 Versões do watchOS anteriores à 8 **Descrição** Foi corrigida uma falha de lógica com restrições aprimoradas, que permitia que um invasor em uma posição privilegiada na rede potencialmente contornasse o HSTS. Isso poderia afetar a integridade dos dados. **Recomendações** Para versões do Safari anteriores à 15, atualize para o Safari 15 ou posterior. Para versões do macOS anteriores à 12.0.1, atualize para o macOS Monterey 12.0.1 ou posterior. Para versões do iOS anteriores à 14.8, atualize para o iOS 14.8 ou posterior. Para versões do iPadOS anteriores à 14.8, atualize para o iPadOS 14.8 ou posterior. Para versões do tvOS anteriores à 15, atualize para o tvOS 15 ou posterior. Para versões do watchOS anteriores à 8, atualize para o watchOS 8 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Cisco IP Phone 8800 Series versions prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX Cisco IP Phone 8800 Series versions prior to 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series **Description** A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. **Recommendations** For Cisco IP Phone 8800 Series versions prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX, update to version 11.0(5) or later to resolve the issue. For Cisco IP Phone 8800 Series versions prior to 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series, update to version 12.5(1)SR1 or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cisco IP Phone 8800 Series versions prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX Cisco IP Phone 8800 Series versions prior to 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series **Description** A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The issue exists because the software fails to sanitize URLs before handling requests. An attacker could exploit this by submitting a crafted URL, potentially gaining unauthorized access to critical services and causing a DoS condition. **Recommendations** For Cisco IP Phone 8800 Series versions prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX, update to version 11.0(5) or later. For Cisco IP Phone 8800 Series versions prior to 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series, update to version 12.5(1)SR1 or later.

**Name of the Vulnerable Software and Affected Versions** Cisco IP Phone 8800 Series versions prior to 12.5(1)SR1 **Description** A vulnerability in the web-based management interface of the Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The issue exists due to the software not restricting the maximum size of certain files that can be written to disk. An attacker with valid administrator credentials could exploit this by sending a crafted, remote connection request to an affected system, allowing them to write a file that consumes most of the available disk space, causing application functions to operate abnormally and leading to a DoS condition. **Recommendations** For versions prior to 12.5(1)SR1, update to version 12.5(1)SR1 or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface for remote connections until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** BlackBerry OS versions prior to 10.2.1.1925 **Description** The issue concerns the Storage and Access service, which fails to enforce password requirements for SMB filesystem access. This allows attackers to read arbitrary files under certain conditions, specifically via sessions over Wi-Fi networks or USB connections when the device is in Development Mode. **Recommendations** For versions prior to 10.2.1.1925, update to version 10.2.1.1925 or later to resolve the issue. As a temporary workaround, consider disabling SMB filesystem access or restricting Wi-Fi and USB connections to minimize the risk of exploitation.