ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Keywords match titles. Record type separates incidents, intel, and research from CVEs.

  1. Research · Nov 29, 2023 · ZeroDay Catalog

    Google Skia Integer Overflow Vulnerability Discovered

    A newly identified integer overflow vulnerability in Google Skia could allow remote attackers to escape the sandbox, impacting multiple Google products.

    What changed

    An integer overflow vulnerability has been identified in Google Skia, a graphics library used in various Google products. This flaw could allow remote attackers to exploit the renderer process, potentially leading to a sandbox escape through specially crafted files.

    Who is affected

    The vulnerability impacts several key products and platforms from Google, which may expose users and organizations to risks if not addressed promptly.

    • Google Chrome
    • ChromeOS
    • Android devices
    • Flutter applications

    What to do

    Organizations using affected Google products should prioritize updating to the latest versions to mitigate the risk associated with this vulnerability. Continuous monitoring for any related security advisories is also recommended.

    • Update Google Chrome and ChromeOS to the latest version.
    • Ensure Android devices are running the most recent updates.
    • Monitor Flutter applications for any patches or updates related to this vulnerability.

    Original report

  2. Research · Nov 21, 2023 · ZeroDay Catalog

    Critical Authentication Vulnerability in ownCloud Exposes User Files

    A severe vulnerability in ownCloud allows unauthorized access to user files under specific conditions, necessitating immediate attention from users and administrators.

    What changed

    A significant vulnerability has been identified in ownCloud versions prior to 10.13.1, which allows attackers to exploit improper authentication mechanisms. This flaw enables unauthorized users to access, modify, or delete files if they know the username of a target user and the target has not configured a signing-key.

    The issue arises from the acceptance of pre-signed URLs without a signing-key, making it critical for users to assess their configurations.

    Who is affected

    This vulnerability impacts various users and organizations utilizing ownCloud, particularly those who have not implemented signing-keys for their file ownership.

    The earliest affected version is 10.6.0, meaning any installations from this version up to 10.13.1 are at risk.

    • ownCloud users without signing-keys configured.
    • Organizations relying on ownCloud for file storage and collaboration.
    • Developers and administrators managing ownCloud installations.

    What to do

    It is imperative for users and administrators to upgrade to ownCloud version 10.13.1 or later to mitigate this vulnerability. Additionally, configuring signing-keys for file ownership is strongly recommended to enhance security.

    Conduct a thorough review of current configurations and ensure that all users are aware of the risks associated with improper authentication.

    • Upgrade to ownCloud version 10.13.1 or later immediately.
    • Configure signing-keys for all file owners to prevent unauthorized access.
    • Review and audit user permissions and configurations regularly.

    Original report