Johnny Yu

**Name of the Vulnerable Software and Affected Versions** Zoom Client for Meetings versions prior to 5.6.3 on Windows Zoom Client for Meetings versions prior to 5.7.3 on macOS Zoom Client for Meetings versions prior to 5.8.6 on Android Zoom Client for Meetings versions prior to 5.8.6 on Linux Zoom Client for Meetings versions prior to 5.9.0 on iOS **Description** The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks. This could lead to availability issues on the client host by exhausting system resources. **Recommendations** For Windows versions prior to 5.6.3, update to version 5.6.3 or later. For macOS versions prior to 5.7.3, update to version 5.7.3 or later. For Android versions prior to 5.8.6, update to version 5.8.6 or later. For Linux versions prior to 5.8.6, update to version 5.8.6 or later. For iOS versions prior to 5.9.0, update to version 5.9.0 or later.

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings versions prior to 5.7.3 Description: The issue concerns a server-side request forgery vulnerability in the chat's "link preview" functionality. If a user enables this feature, a malicious actor could trick the user into sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly. Recommendations: For versions prior to 5.7.3, update to version 5.7.3 or later to resolve the issue. As a temporary workaround, consider disabling the "link preview" feature in the chat until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** The issue is related to a vulnerability in the web-based management interface of Cisco SD-WAN vManage Software. It is caused by insufficient file scope limiting, allowing an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This can be exploited by creating a specific file reference on the file system and then accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the file system of the underlying operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** The issue is related to a vulnerability in the web-based management interface of Cisco SD-WAN vManage Software. This vulnerability could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** The issue is related to improper handling of XML External Entity (XXE) entries when parsing certain XML files in the web UI of Cisco SD-WAN vManage Software. This could allow an authenticated, remote attacker to gain read and write access to information stored on an affected system. The attacker could exploit this by persuading a user to import a crafted XML file with malicious entries, potentially allowing the attacker to read and write files within the affected application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** The issue is related to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this by persuading a user to import a crafted XML file with malicious entries, potentially gaining read and write access to information stored on the affected system. This could allow the attacker to read and write files within the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** The issue is due to insufficient input sanitization during user authentication processing, allowing an authenticated, remote attacker to execute code with root privileges on an affected system. An attacker could exploit this by sending a crafted response to the Cisco SD-WAN vManage Software, potentially accessing the software and executing unauthorized commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** The issue is related to a problem with the web-based management interface of Cisco SD-WAN vManage Software, where an incorrect link resolution before accessing a file can be exploited. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability is due to insufficient file scope limiting, which can be exploited by creating a specific file reference on the filesystem and accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the filesystem of the underlying operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco SD-WAN vManage Software (affected versions not specified) **Description** The issue is related to the improper restriction of XML external entity references in the web interface of Cisco SD-WAN vManage Software. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability is due to the improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this by persuading a user to import a crafted XML file with malicious entries, potentially allowing the attacker to read and write files within the affected application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.4 macOS Mojave versions prior to 10.14.6 tvOS versions prior to 12.4 Safari versions prior to 12.1.2 iTunes for Windows versions prior to 12.9.6 iCloud for Windows versions prior to 7.13 and 10.6 **Description** The issue is related to memory corruption and can be exploited by processing maliciously crafted web content, potentially leading to arbitrary code execution. It is associated with a buffer overflow in the WebKit display module. Exploitation of this issue may allow a remote attacker to execute arbitrary code using a specially crafted web page. **Recommendations** For iOS versions prior to 12.4, update to iOS 12.4 or later. For macOS Mojave versions prior to 10.14.6, update to macOS Mojave 10.14.6 or later. For tvOS versions prior to 12.4, update to tvOS 12.4 or later. For Safari versions prior to 12.1.2, update to Safari 12.1.2 or later. For iTunes for Windows versions prior to 12.9.6, update to iTunes for Windows 12.9.6 or later. For iCloud for Windows versions prior to 7.13 and 10.6, update to iCloud for Windows 7.13 or 10.6 or later.