Roman Shafigullin

**Name of the Vulnerable Software and Affected Versions** Netty versions 3.9.7 and earlier, 3.10.x prior to 3.10.3.Final, 4.0.x prior to 4.0.28.Final, 4.1.x prior to 4.1.0.Beta5 Play Framework versions 2.x prior to 2.3.9 **Description** The issue allows remote attackers to bypass the httpOnly flag on cookies, potentially obtaining sensitive information. This is due to improper validation of cookie name and value characters. **Recommendations** For Netty versions 3.9.7 and earlier, update to version 3.9.8.Final or later. For Netty versions 3.10.x prior to 3.10.3.Final, update to version 3.10.3.Final or later. For Netty versions 4.0.x prior to 4.0.28.Final, update to version 4.0.28.Final or later. For Netty versions 4.1.x prior to 4.1.0.Beta5, update to version 4.1.0.Beta5 or later. For Play Framework versions 2.x prior to 2.3.9, update to version 2.3.9 or later.

**Name of the Vulnerable Software and Affected Versions** Ember.js versions 1.8.x through 1.10.x Ember.js versions 1.11.x before 1.11.4 Ember.js versions 1.12.x before 1.12.2 Ember.js versions 1.13.x before 1.13.12 Ember.js versions 2.0.x before 2.0.3 Ember.js versions 2.1.x before 2.1.2 Ember.js versions 2.2.x before 2.2.1 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be exploited by attackers to execute malicious scripts on the client-side. **Recommendations** For Ember.js versions 1.8.x through 1.10.x, update to a version outside of this range to mitigate the risk. For Ember.js versions 1.11.x before 1.11.4, update to version 1.11.4 or later. For Ember.js versions 1.12.x before 1.12.2, update to version 1.12.2 or later. For Ember.js versions 1.13.x before 1.13.12, update to version 1.13.12 or later. For Ember.js versions 2.0.x before 2.0.3, update to version 2.0.3 or later. For Ember.js versions 2.1.x before 2.1.2, update to version 2.1.2 or later. For Ember.js versions 2.2.x before 2.2.1, update to version 2.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 7 through 9 **Description** The issue allows remote attackers to obtain sensitive information from process memory via a crafted HTML document. An information disclosure vulnerability exists that could allow an attacker to gain access and read Internet Explorer's process memory. An attacker could exploit the vulnerability by constructing a specially crafted webpage that could allow information disclosure if a user viewed the webpage. An attacker who successfully exploited this issue could view content from Internet Explorer's process memory. **Recommendations** For Microsoft Internet Explorer versions 7 through 9, at the moment, there is no information about a newer version that contains a fix for this issue.