Rafay Baloch

**Name of the Vulnerable Software and Affected Versions** PureVPN Linux client version 2.0.2 **Description** The PureVPN Linux client fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default DNS servers. This issue is related to improper access controls in the DNS query handler. **Recommendations** For PureVPN Linux client version 2.0.2, upgrade to version 2.0.3 to remediate the issue. As a temporary workaround, consider restricting access to the DNS query handler until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to macOS Sonoma 14.1 **Description** The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to spoof the user interface. Visiting a malicious website may lead to user interface spoofing. This is a variant of a regression bug. **Recommendations** For versions prior to macOS Sonoma 14.1, update to macOS Sonoma 14.1 to fix the issue. As a temporary workaround, consider avoiding visits to untrusted websites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge for iOS (affected versions not specified) **Description** The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to perform a spoofing attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuTScloud versions prior to c5.0.1.1949 QuTS hero versions prior to h5.0.0.1949 build 20220215 and h4.5.4.1951 build 20220218 QTS versions prior to 5.0.0.1986 build 20220324 and 4.5.4.1991 build 20220329 QVR Pro Appliance (affected versions not specified) **Description** A path traversal vulnerability has been reported, allowing attackers to read the contents of unexpected files and expose sensitive data. The issue is related to insufficient directory path name restrictions in the QTS and QuTS hero operating systems. If exploited, this vulnerability can allow a remote attacker to impact the confidentiality of information. **Recommendations** For QuTScloud versions prior to c5.0.1.1949, update to QuTScloud c5.0.1.1949 or later. For QuTS hero versions prior to h5.0.0.1949 build 20220215, update to QuTS hero h5.0.0.1949 build 20220215 or later. For QuTS hero versions prior to h4.5.4.1951 build 20220218, update to QuTS hero h4.5.4.1951 build 20220218 or later. For QTS versions prior to 5.0.0.1986 build 20220324, update to QTS 5.0.0.1986 build 20220324 or later. For QTS versions prior to 4.5.4.1991 build 20220329, update to QTS 4.5.4.1991 build 20220329 or later. For QVR Pro Appliance, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Turtlapp Turtle Note version 0.7.2.6 **Description** The issue allows attackers to execute HTML injection due to the lack of filtering of the <meta> tag during markdown parsing. **Recommendations** For version 0.7.2.6, as a temporary workaround, consider disabling markdown parsing until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 14.0 **Description** An inconsistent user interface issue was addressed with improved state management. Visiting a malicious website may lead to address bar spoofing. **Recommendations** For versions prior to 14.0, update to Safari 14.0 to resolve the issue. As a temporary workaround, consider avoiding visits to untrusted or malicious websites until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Yandex Browser versions prior to 3.3.9 RITS Browser version 3.3.9 and prior versions **Description** The issue is related to the User Interface (UI) Misrepresentation of Critical Information in the address bar, allowing an attacker to hide the true source of data. **Recommendations** For Yandex Browser versions prior to 3.3.9, update to a version newer than 3.3.9 to resolve the issue. For RITS Browser version 3.3.9 and prior versions, update to a version newer than 3.3.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** UC Browser versions prior to 13.0.8 **Description** The issue is related to the User Interface (UI) Misrepresentation of Critical Information in the address bar of UC Browser, allowing an attacker to obfuscate the true source of data as presented in the browser. **Recommendations** For versions prior to 13.0.8, update to a version newer than 13.0.8 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** UC Browser versions prior to 13.0.8 **Description** The issue is related to the User Interface (UI) Misrepresentation of Critical Information in the address bar of UC Browser, allowing an attacker to obfuscate the true source of data as presented in the browser. **Recommendations** For versions prior to 13.0.8, update to version 13.0.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bolt Browser versions 1.4 and prior **Description** The issue allows an attacker to obfuscate the true source of data as presented in the browser due to a User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser. **Recommendations** For Bolt Browser versions 1.4 and prior, update to a version later than 1.4 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Yandex Browser versions prior to 20.8.4 Description: The issue is related to the misrepresentation of critical information in the address bar of the Yandex Browser, allowing an attacker to obfuscate the true source of data as presented in the browser. This can be exploited to conduct spoofing attacks. Recommendations: For versions prior to 20.8.4, update to version 20.8.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12 Safari versions prior to 12 **Description** A logic issue was addressed with improved state management. **Recommendations** For iOS versions prior to 12, update to iOS 12 or later. For Safari versions prior to 12, update to Safari 12 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 48.0 on Android **Description** The issue exists due to insufficient input validation, allowing a remote attacker to spoof the address bar by using left-to-right characters in conjunction with a right-to-left character set. **Recommendations** For versions prior to 48.0 on Android, update to version 48.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Open Flash Chart versions prior to the version used in Pretty Link Lite 1.6.3 Pretty Link Lite plugin versions prior to 1.6.3 JNews (com jnews) component version 8.0.1 CiviCRM versions 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `get-data` parameter. This affects various software products, including the Pretty Link Lite plugin for WordPress, JNews component for Joomla!, and CiviCRM. **Recommendations** For Pretty Link Lite plugin versions prior to 1.6.3, update to version 1.6.3 or later. For JNews (com jnews) component version 8.0.1, consider disabling the component until a patch is available. For CiviCRM versions 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, update to a version outside of these ranges. As a temporary workaround, consider restricting access to the `get-data` parameter in the affected API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** prettyPhoto versions 3.1.4 and earlier **Description** The issue is related to a cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted PATH INFO to the default URI. **Recommendations** For prettyPhoto versions 3.1.4 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.