Hardik Mehta

**Name of the Vulnerable Software and Affected Versions** Apache Artemis versions 2.50.0 through 2.51.0 Apache ActiveMQ Artemis versions 2.11.0 through 2.44.0 **Description** A missing authentication check for a critical function exists in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can leverage the Core protocol to force a broker to establish an outbound Core federation connection to a rogue broker controlled by the attacker. This could lead to message injection into any queue and/or message exfiltration from any queue through the rogue broker. The issue impacts environments that permit both incoming Core protocol connections from untrusted sources and outgoing Core protocol connections to untrusted targets. **Recommendations** Upgrade to Apache Artemis version 2.52.0. Remove Core protocol support from any acceptor receiving connections from untrusted sources. Use two-way SSL (certificate-based authentication) to require clients to present a valid SSL certificate before any message protocol handshake.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 15 iPadOS versions prior to 15 **Description** An access issue was addressed with improved access restrictions. An attacker in a privileged network position may be able to leak sensitive user information. **Recommendations** For iOS versions prior to 15, update to iOS 15 or later to resolve the issue. For iPadOS versions prior to 15, update to iPadOS 15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WebKitGTK+ versions prior to 2.21.4 **Description** The issue arises from the `webkitFaviconDatabaseSetIconForPageURL` and `webkitFaviconDatabaseSetIconURLForPageURL` functions in `UIProcess/API/glib/WebKitFaviconDatabase.cpp` of WebKit, which is used in WebKitGTK+. The functions mishandle an unset `pageURL`, resulting in an application crash. **Recommendations** For WebKitGTK+ versions prior to 2.21.4, update to version 2.21.4 or later to resolve the issue.