UCSF IT Technology

GitLab released  security updates to address a Critical vulnerability in self-managed installations of the GitLab Community Edition (CE) and Enterprise Edition (EE). An unauthenticated attacker with access to any signed saml document (by the IdP) can forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as an arbitrary user within the vulnerable system.

Google has released new versions of Chrome to address vulnerabilities in Google Chrome. For a complete description of the vulnerabilities and affected systems go to Chrome Releases.IT Security Read more about IT Security service offerings.

VMware has released security updates to address Critical vulnerabilities affecting the VMware vCenter Server platform. An attacker with network access to the server could send a specially crafted packet to execute remote code.

D-Link released security updates to address Critical vulnerabilities in the D-Link Routers. An attacker could exploit this vulnerability to execute arbitrary code or access the devices using hardcoded credentials.

Apple has released security updates to address vulnerabilities in multiple Apple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. 

0-Day Vulnerabilities are being exploited through disabled Microsoft Internet Explorer browsers.

Apple has released a security update to address a vulnerability in Apple Vision Pro. An attacker could exploit this vulnerability to infer what a Vision Pro user is typing by tracking the eye movement of their avatar.

SAP released its August 2024 updates to address vulnerabilities in multiple SAP products.

Google has released new versions of Chrome to address vulnerabilities in Google Chrome.For a complete description of the vulnerabilities and affected systems go to Chrome Releases. IT Security Read more about IT Security service offerings.

GitLab released a security update to address Critical and other vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Attacker can exploit these vulnerabilities to trigger pipelines as arbitrary users under certain conditions.