UCSF IT Technology

Threat Alert: TOAD ATTA

Openwall reported a vulnerability in OpenSSH. An attacker could exploit these vulnerabilities to perform remote code execution.For a complete description of the vulnerabilities and affected systems go to CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems.IT SecurityRead more about IT Security service offerings.

InkBridge Networks released a technical description of what is being called the BlastRADIUS attack on the RADIUS Protocol and warned that networks are exposed to major risk. A local attacker can exploit this vulnerability to modify valid responses. For a complete description of the vulnerabilities and affected systems go to IT SecurityRead more about IT Security service offerings.

SAP released its July 2024 updates to address vulnerabilities in multiple SAP products. For a complete description of the vulnerabilities and affected systems go to SAP Security Patch Day – July 2024.IT SecurityRead more about IT Security service offerings. 

Microsoft released their July Security Updates to address an Actively Exploited and other vulnerabilities in multiple Microsoft products. An attacker can exploit some of these vulnerabilities to take control of an affected system.For a complete description of the vulnerabilities and affected systems go to Microsoft July 2024 Security Updates.IT Security

Adobe has released security updates to address Critical and other vulnerabilities in multiple Adobe products.For a complete description of the vulnerabilities and affected systems go to Adobe Security Bulletins.IT SecurityRead more about IT Security service offerings.

Citrix has released security updates to address vulnerabilities in multiple Citrix products. 

Cisco has released a security advisory to address a High vulnerability in multiple Cisco products. An unauthenticated remote attacker could exploit this vulnerability to perform remote code execution (RCE).

Ghostscript released a security update to address an Actively Exploited and other vulnerabilities in Ghostscript. An attacker can exploit  this vulnerability to perform remote code execution (RCE).For a complete description of the vulnerabilities and affected systems go to Ghostscript 10.03.1 (2024-05-02) fixed 5 CVEs including CVE-2024-33871 arbitrary code execution.IT Security

Google released the July Pixel update to address vulnerabilities in Pixel Devices.For a complete description of the vulnerabilities and affected systems go to Pixel Update Bulletin—July 2024.IT SecurityRead more about IT Security service offerings.