Yadhu Krishna M

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.6 Safari versions prior to 17.6 macOS Monterey versions prior to 12.7.6 macOS Ventura versions prior to 13.6.8 **Description** The issue was addressed with improved UI handling. Visiting a website that frames malicious content may lead to UI spoofing. **Recommendations** For macOS Sonoma versions prior to 14.6, update to macOS Sonoma 14.6. For Safari versions prior to 17.6, update to Safari 17.6. For macOS Monterey versions prior to 12.7.6, update to macOS Monterey 12.7.6. For macOS Ventura versions prior to 13.6.8, update to macOS Ventura 13.6.8.

**Name of the Vulnerable Software and Affected Versions** Node.js versions v16 through v20 **Description** The issue is related to the llhttp parser in the http module, which does not strictly use the CRLF sequence to delimit HTTP requests, leading to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser, contrary to RFC7230 section 3, which states that only the CRLF sequence should delimit each header-field. **Recommendations** For Node.js versions v16 through v20, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/hoppscotch/proxyscotch versions prior to 1.0.0 **Description** The issue occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user, leading to a leakage of sensitive information from the server. This happens when the interceptor mode is set to proxy. **Recommendations** For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the proxy interceptor mode until a patch is available. Restrict access to untrusted URLs to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** sqlite-web versions (all versions) **Description** The issue concerns a lack of validation for requests in the SQL dashboard area, allowing sensitive actions to be performed without proper verification of the request's origin. This could enable an attacker to trick a user into performing unintended actions through a Cross Site Request Forgery (CSRF) attack. **Recommendations** For all versions, consider implementing proper request validation to ensure that actions in the SQL dashboard area originate from the application, mitigating the risk of CSRF attacks. As a temporary workaround, restrict access to the SQL dashboard area to minimize the risk of exploitation.