UCSF IT Technology

H-ISAC reported that a vulnerability in Windows Secure Boot Likely Weaponized. This vulnerabilities could allow an attacker to bypass the secure boot feature. For a complete description of the vulnerabilities and affected systems go to CVE-2022-21894 Detail. IT Security Read more about IT Security service offerings.

Apple has released a security update to address vulnerabilities in multiple Apple Products. A remote attacker could exploit these vulnerabilities to take control of an affected device.

Microsoft released an out-of-band security update to address a vulnerability in Microsoft Windows Screenshot Tools. A malicious actor could exploit this vulnerability to recover edited portions of screenshots, potentially revealing sensitive information that may have been cropped out.

Mandiant reported a Critical vulnerability in Apache HTTP Server 2.4.54. This vulnerability could be exploited to perform a HTTP Request Smuggling attack. For a complete description of the vulnerabilities and affected systems go to CVE-2023-25690 Detail. IT Security Read more about IT Security service offerings.

Veeam has released a security update to address a vulnerability in Veeam Backup & Replication. These vulnerabilities could allow an unauthenticated, remote attacker to gain access to the backup infrastructure hosts. For a complete description of the vulnerabilities and affected systems go to CVE-2023-27532. IT Security Read more about IT Security service offerings.

Google released Chrome 111.0.5563.110 for Mac and Linux and 111.0.5563.110/.111 for Windows to address a vulnerabilities in Chrome.  For a complete description of the vulnerabilities and affected systems go to Chrome Stable Channel Update. IT Security

Samsung released a security update to address High vulnerabilities in Android handsets, wearables, and in-car infotainment systems. A remote attacker could exploit these vulnerabilities to create an operational exploit to compromise affected devices.

Threat Alert: What to Watch For The US Federal Trade Commission has warned of AI-enhanced voice phishing (vishing) calls impersonating loved ones in distress.  The calls use an AI system to create a believable clone of a loved one’s voice based off publicly accessible voice samples on platforms like YouTube, TikTok, or Instagram.  The impersonated individual will claim to be in distress and ask f

Threat Alert: What to Watch For Scammers are creating fake customer support Twitter accounts for various banks and financial institutions.