Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Affected Systems:
Risk:
Remediation Recommendations
Ensure all Microsoft products have the latest version(s) installed.
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
A vulnerability has been discovered in Apple products, which could allow for privilege escalation. Successful exploitation of this vulnerability could allow for privilege escalation in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Affected Systems:
Versions of iOS before 16.6
Risk:
Remediation Recommendations
Ensure Apple software has the latest version(s) installed.
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
Multiple vulnerabilities have been discovered in ChromeOS, the most severe of which could allow for arbitrary code execution. ChromeOS is a Linux-based operating system developed and designed by Google. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Affected Systems:
ChromeOS versions prior to 118.0.5993.86 (Platform version: 15604.45.0)
Risk:
Remediation Recommendations
Ensure all devices running ChromeOS have the latest version available installed.
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it
References
Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.
Affected Systems:
Risk:
Remediation Recommendation
Ensure all devices running Google Android OS have the latest version available installed.
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
SlashNext outlines QR code phishing, or “quishing,” noting that users should treat QR codes with the same wariness warranted by normal URLs: “Traditional security filters, including Microsoft SafeLinks and other URL rewriting solutions, often focus on URLs. By using QR codes instead, attackers can sidestep these filters, making their phishing attempts more likely to succeed.”
SlashNext adds, “QR codes are used in various contexts, such as marketing campaigns, ticketing systems, and contactless payments. This wide range of applications provides hackers with numerous opportunities to exploit QR codes for their malicious purposes.”