ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 31, 2023 · ZeroDay Catalog

    Critical Improper Authorization Vulnerability in Atlassian Confluence Data Center and Server

    An improper authorization vulnerability has been identified in all versions of Atlassian Confluence Data Center and Server, allowing potential unauthorized administrative access.

    What changed

    A significant vulnerability has been discovered in Atlassian Confluence Data Center and Server that allows unauthenticated attackers to reset the application and create an administrator account. This vulnerability has not yet been exploited in the wild but poses a serious risk to affected systems.

    Once an attacker gains administrative access, they can execute all administrative functions, resulting in a complete compromise of the system's confidentiality, integrity, and availability.

    Who is affected

    All versions of Atlassian Confluence Data Center and Server are impacted by this vulnerability. Organizations using these products should be particularly vigilant.

    Atlassian Cloud sites are not affected, which provides some assurance to users of the cloud-based service.

    • Atlassian Confluence Data Center
    • Atlassian Confluence Server
    • Organizations using self-hosted Confluence instances

    What to do

    Immediate action is recommended for organizations running affected versions of Confluence Data Center and Server. It is crucial to assess your current version and apply necessary mitigations.

    Ensure that access controls are strictly enforced and monitor for any unauthorized access attempts.

    • Review and update your Confluence instance to the latest version.
    • Implement strict access controls to limit exposure.
    • Monitor logs for unusual activities that may indicate attempts to exploit this vulnerability.

    Original report

  2. Oct 26, 2023 · ZeroDay Catalog

    Critical Vulnerability in NextGen Healthcare Mirth Connect Exposes Systems to Remote Code Execution

    A serious vulnerability has been identified in NextGen Healthcare's Mirth Connect, allowing for unauthenticated remote code execution due to an incomplete patch.

    What changed

    NextGen Healthcare's Mirth Connect prior to version 4.4.1 contains a critical vulnerability that permits unauthenticated remote code execution. This issue arises from an incomplete patch for CVE-2023-37679, leaving systems exposed to potential exploitation.

    Organizations using affected versions should assess their deployments immediately to mitigate risks associated with this vulnerability.

    Who is affected

    The vulnerability impacts various stakeholders relying on Mirth Connect for healthcare data integration and management.

    Affected parties include healthcare providers, software developers utilizing Mirth Connect, and organizations involved in health information exchange.

    • NextGen Healthcare Mirth Connect versions before 4.4.1
    • Healthcare providers using Mirth Connect for data integration
    • Software developers leveraging Mirth Connect APIs
    • Organizations engaged in health information exchange

    What to do

    It is crucial for organizations to upgrade to Mirth Connect version 4.4.1 or later to eliminate the risk posed by this vulnerability. Additionally, a review of security practices surrounding data handling and integration should be conducted.

    Monitoring for unusual activity and implementing additional security measures can help mitigate the risk of potential exploitation.

    • Upgrade to Mirth Connect version 4.4.1 or later
    • Conduct a security review of data handling practices
    • Monitor systems for unusual activity
    • Implement additional security measures as necessary

    Original report