Wenxu Wu

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 84.0.4147.89 **Descrição** Uma falha de contorno de política no componente Política de Segurança de Conteúdo (CSP) do Google Chrome permitiu que um invasor remoto contornasse a política de segurança de conteúdo por meio de uma página HTML maliciosa. A vulnerabilidade está relacionada a um controle de acesso incorreto, o que poderia permitir que um invasor remoto comprometesse a integridade dos dados. Estima-se que quase todos os sites do mundo estejam em risco devido a essa falha. A vulnerabilidade poderia potencialmente expor senhas em texto simples por meio da interface do usuário ou em arquivos locais. **Recomendações** Para versões do Google Chrome anteriores à 84.0.4147.89, atualize para a versão 84.0.4147.89 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso a dados confidenciais e evitar o uso de senhas em texto simples em arquivos locais até que a atualização seja aplicada.

**Nome do software vulnerável e versões afetadas** Windows (versões afetadas não especificadas) **Descrição** O problema está relacionado a uma vulnerabilidade de elevação de privilégios na pasta “Public Account Pictures”, que lida incorretamente com junções. Para explorar essa vulnerabilidade, um invasor deve primeiro obter acesso de execução no sistema da vítima. Isso permite que o invasor potencialmente eleve seus privilégios. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Ferramenta de Remoção de Software Malicioso do Windows (MSRT) (versões afetadas não especificadas) **Descrição** Existe uma vulnerabilidade de elevação de privilégios devido ao tratamento inadequado de junções pela Ferramenta de Remoção de Software Malicioso do Windows (MSRT). Para explorar essa vulnerabilidade, um invasor deve primeiro obter acesso de execução no sistema da vítima. A vulnerabilidade pode ser explorada por um aplicativo especialmente criado, permitindo que um invasor eleve seus privilégios. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Serviço de Perfil do Usuário do Windows (ProfSvc) (versões afetadas não especificadas) **Descrição** O problema está relacionado ao tratamento inadequado de links simbólicos pelo Serviço de Perfil do Usuário do Windows, o que pode permitir que um invasor eleve seus privilégios. Isso pode afetar potencialmente o sistema. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 79.0.3945.79 **Description** The issue is related to incorrect security UI in interstitials, which can be exploited by a remote attacker to perform domain spoofing via a crafted HTML page. This can potentially impact the integrity of data. The vulnerability is associated with an insufficient input validation mechanism. **Recommendations** For versions prior to 79.0.3945.79, update to version 79.0.3945.79 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 77.0.3865.75 **Description** The issue is related to insufficient input validation in the Chromium browser's user interface, which can be exploited by a remote attacker using a specially crafted HTML page. This can lead to data integrity violations. The problem is described as UI spoofing, allowing an attacker to spoof notifications. **Recommendations** For versions prior to 77.0.3865.75, update to version 77.0.3865.75 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied. Avoid using the browser for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 77.0.3865.75 **Description** The issue concerns a UI spoofing problem in Chromium, which is part of Google Chrome. It allows a remote attacker to spoof notifications by using a crafted HTML page. The vulnerability is related to insufficient input validation, potentially enabling a remote attacker to compromise data integrity via a specially crafted HTML page. **Recommendations** For versions prior to 77.0.3865.75, update to version 77.0.3865.75 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 77.0.3865.75 **Description** The issue is related to insufficient policy enforcement in Chromium, allowing a remote attacker to perform domain spoofing via a crafted HTML page. This can potentially disrupt data integrity by exploiting the vulnerability with a specially crafted HTML page. **Recommendations** For versions prior to 77.0.3865.75, update to version 77.0.3865.75 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to errors in handling hard links in the Windows AppX Deployment Service (AppXSVC), which can be exploited by an attacker to elevate their privileges using a specially crafted application. An elevation-of-privilege vulnerability allows attackers to affect the system. There have been reports of a bypass for the recent Windows patch, with a second zero-day exploit disclosed that apparently bypasses Microsoft's patch for a Windows Elevation of Privilege (EoP) vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1.1 Safari versions prior to 12.0.2 iTunes for Windows versions prior to 12.9.2 iCloud for Windows versions prior to 7.9 Description: A logic issue was addressed with improved state management. Recommendations: For iOS versions prior to 12.1.1, update to iOS 12.1.1 or later. For Safari versions prior to 12.0.2, update to Safari 12.0.2 or later. For iTunes for Windows versions prior to 12.9.2, update to iTunes 12.9.2 or later. For iCloud for Windows versions prior to 7.9, update to iCloud for Windows 7.9 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 71.0.3578.80 **Description** The issue is related to insufficient validation of external protocols in Shell Integration, allowing a remote attacker to launch external programs via a crafted HTML page. This can be achieved by exploiting the vulnerability with a specially designed HTML page. **Recommendations** For versions prior to 71.0.3578.80, update to version 71.0.3578.80 or later to resolve the issue. As a temporary workaround, consider restricting access to external protocols in Shell Integration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 71.0.3578.80 **Description** The issue is related to a failure in dismissing http auth dialogs during navigation in Network Authentication in Google Chrome on Android. This allowed a remote attacker to deceive the user about the origin of an auto dialog by using a crafted HTML page. The vulnerability is associated with an error in the implementation of network authentication. **Recommendations** For versions prior to 71.0.3578.80, update to version 71.0.3578.80 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Gogs version 0.11.53 **Description** The issue allows an attacker to trigger MIME type sniffing using a crafted .eml file, leading to XSS. This is demonstrated by Internet Explorer and is caused by the lack of an "X-Content-Type-Options: nosniff" header. **Recommendations** For Gogs version 0.11.53, consider implementing the "X-Content-Type-Options: nosniff" header to prevent MIME type sniffing and mitigate the risk of XSS. As a temporary workaround, restrict the handling of .eml files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Gogs versions prior to 0.11.53 **Description** A CSRF issue in the admin panel allows remote attackers to execute admin operations via a crafted issue or link. **Recommendations** For versions prior to 0.11.53, update to version 0.11.53 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin panel to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gitea versions through 1.5.0-rc2 Gogs versions through 0.11.53 **Description** A Server-Side Request Forgery (SSRF) issue in webhooks affects Gitea and Gogs, allowing remote attackers to access intranet services. **Recommendations** For Gitea versions through 1.5.0-rc2, update to a version newer than 1.5.0-rc2 to resolve the issue. For Gogs versions through 0.11.53, update to a version newer than 0.11.53 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 66.0.3359.117 Opera (affected versions not specified) **Description** A remote attacker could obscure the full screen warning via a crafted HTML page by overlapping the fullscreen notification in Fullscreen with a JavaScript focused window. **Recommendations** For Google Chrome versions prior to 66.0.3359.117, update to version 66.0.3359.117 or later to resolve the issue. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 65.0.3325.146 Opera (affected versions not specified) **Description** A remote attacker could potentially enumerate internal host services via a crafted HTML page by including port 22 in the list of allowed FTP ports in Networking. This issue affects Google Chrome and Opera browsers. **Recommendations** For Google Chrome versions prior to 65.0.3325.146, update to version 65.0.3325.146 or later to resolve the issue. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 64.0.3282.119 **Description** The issue concerns an incorrect security UI in permissions prompts, allowing a remote attacker to spoof the origin to which permission is granted. This can be achieved via a crafted HTML page. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Google Chrome versions prior to 64.0.3282.119, update to version 64.0.3282.119 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 64.0.3282.119 **Description** The issue is related to insufficient policy enforcement in Blink, allowing a remote attacker to potentially bypass content security policy. This can be achieved via a crafted HTML page. **Recommendations** For versions prior to 64.0.3282.119, update to version 64.0.3282.119 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 63.0.3239.84 Opera (affected versions not specified) **Description** The issue is related to insufficient policy enforcement in the Omnibox feature, allowing a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. This enables the attacker to deceive users into thinking they are visiting a legitimate website when, in fact, they are being redirected to a malicious site. **Recommendations** For Google Chrome versions prior to 63.0.3239.84, update to version 63.0.3239.84 or later to resolve the issue. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.