Johannes Kuhn

**Name of the Vulnerable Software and Affected Versions** ZNC versions prior to 1.9.1 **Description** The issue allows for remote code execution in the modtcl module of ZNC, which can be triggered through a prepared kick message. **Recommendations** For versions prior to 1.9.1, update to version 1.9.1 or later to resolve the issue. As a temporary workaround, consider disabling the modtcl module until a patch is available. Restrict access to the modtcl module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Java SE versions 8u251, 11.0.7, and 14.0.1 Java SE Embedded version 8u251 **Description** The issue is related to insufficient input validation in the Libraries component of Oracle Java SE and Java SE Embedded. It allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE and Java SE Embedded. Successful attacks can result in unauthorized update, insert, or delete access to some Java SE and Java SE Embedded accessible data, as well as unauthorized read access to a subset of Java SE and Java SE Embedded accessible data. This vulnerability can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component without using sandboxed applications or applets. **Recommendations** For Java SE versions 8u251, 11.0.7, and 14.0.1, update to a version that contains the fix for this issue. For Java SE Embedded version 8u251, update to a version that contains the fix for this issue. As a temporary workaround, consider restricting access to the Libraries component until a patch is available. Avoid using the vulnerable APIs in the specified component until the issue is resolved.