Zhiyi Zhang

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 120.0.6099.109 **Description** The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker using a specially crafted HTML page, potentially leading to heap corruption or arbitrary code execution. The estimated severity of this issue is high. It has been reported that Google paid out $50,000 in bug bounties related to this and other vulnerabilities. **Recommendations** For Google Chrome versions prior to 120.0.6099.109, update to version 120.0.6099.109 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied. Avoid using the `Promise.any` function in sensitive contexts until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 110.0.5481.177 Microsoft Edge (affected versions not specified) **Description** The issue is related to an integer overflow in the PDF viewer function, which could allow a remote attacker to exploit heap corruption via a crafted PDF file. This may impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Google Chrome versions prior to 110.0.5481.177, update to version 110.0.5481.177 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows DNS Server (affected versions not specified) **Description** The issue is related to errors in processing DNS requests. It allows a remote attacker to cause a denial of service using a specially crafted DNS request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows DNS Server (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Windows DNS Server component, which can be exploited by a remote attacker to cause a denial of service. This can affect the system's operation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.15.6 Security Update versions prior to 2020-004 for Mojave and High Sierra Description: A local user may cause unexpected system termination or read kernel memory due to an out-of-bounds read issue, which has been addressed with improved input validation. Recommendations: For macOS versions prior to 10.15.6, update to macOS Catalina 10.15.6. For Mojave, apply Security Update 2020-004. For High Sierra, apply Security Update 2020-004.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to a vulnerability in the Oracle WebLogic Server product, specifically in the Console component. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server, potentially resulting in a takeover. The vulnerability is easily exploitable and can impact the confidentiality, integrity, and availability of the server. It is associated with errors in code generation management and can be exploited using HTTP requests. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the emergency patch released by Oracle to fix this critical flaw. As a temporary workaround, consider restricting access to the Console component until a patch is applied. Avoid using the vulnerable Console component in the affected Oracle WebLogic Server versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.15.1 Security Update versions prior to 2019-001 Security Update versions prior to 2019-006 **Description** A memory corruption issue was addressed with improved memory handling, allowing an application to potentially execute arbitrary code with system privileges. **Recommendations** For macOS versions prior to 10.15.1, update to macOS Catalina 10.15.1 or later. For systems requiring Security Update 2019-001 or 2019-006, apply the respective security update to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue is related to a remote code execution problem in the ChakraCore scripting engine, caused by a buffer overflow in memory. This could allow an attacker to execute arbitrary code with the same user rights as the current user by using a specially crafted web page. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view or modify data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to errors in handling objects in memory, specifically in the Internet Connection Sharing (ICS) function of the Windows operating system. This can allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.14.4 **Description** A buffer overflow issue was addressed through improved size validation, which could allow a malicious application to execute arbitrary code with kernel privileges. **Recommendations** For versions prior to 10.14.4, update to macOS Mojave 10.14.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. It could allow a remote attacker to execute arbitrary code using a specially crafted web page. The vulnerability can corrupt memory, enabling an attacker to gain the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to the improper handling of objects in memory by the Windows kernel, which can lead to the disclosure of protected information. An attacker could exploit this by using a specially crafted application to reveal sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. This could allow a remote attacker to execute arbitrary code, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 12.1 iOS versions prior to 12.2 tvOS versions prior to 12.2 watchOS versions prior to 5.2 iTunes versions prior to 12.9.4 for Windows iCloud for Windows versions prior to 7.11 **Description** The issue is related to insufficient input validation in the WebKit display module. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information. Processing maliciously crafted web content may result in the disclosure of process memory. **Recommendations** For Safari versions prior to 12.1, update to Safari 12.1 or later. For iOS versions prior to 12.2, update to iOS 12.2 or later. For tvOS versions prior to 12.2, update to tvOS 12.2 or later. For watchOS versions prior to 5.2, update to watchOS 5.2 or later. For iTunes versions prior to 12.9.4 for Windows, update to iTunes 12.9.4 for Windows or later. For iCloud for Windows versions prior to 7.11, update to iCloud for Windows 7.11 or later.

**Name of the Vulnerable Software and Affected Versions** ChakraCore (affected versions not specified) **Description** An information disclosure issue exists due to improper memory handling by Chakra, potentially allowing an attacker to gain information that could further compromise a user's computer or data. To exploit this, an attacker must be aware of the memory address where an object was created. The issue is related to errors in handling internal data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.3 Description: The issue is related to insufficient access control in the WLS Core Components subcomponent of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via the T3 protocol to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. Recommendations: For versions 10.3.6.0, 12.1.3.0, and 12.2.1.3, consider restricting access to the T3 protocol until a patch is available. As a temporary workaround, limit network access to the Oracle WebLogic Server to minimize the risk of exploitation. Avoid using the Oracle WebLogic Server for critical applications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.