ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Nov 15, 2023 · ZeroDay Catalog

    Critical Vulnerability in Qlik Sense Allows Remote Code Execution

    A newly discovered vulnerability in Qlik Sense could allow unauthenticated remote code execution, impacting multiple versions of the software.

    What changed

    A significant vulnerability has been identified in Qlik Sense Enterprise for Windows, allowing attackers to execute unauthorized HTTP requests on the backend server. This issue arises from improper validation of HTTP headers, enabling privilege escalation through HTTP tunneling.

    The vulnerability, cataloged as CVE-2023-41265, affects versions of Qlik Sense prior to the August 2023 Patch 2. It is crucial for users to understand the implications of this flaw and take immediate action to secure their systems.

    Who is affected

    Organizations using Qlik Sense Enterprise for Windows are at risk if they have not applied the necessary patches. The vulnerability impacts various versions of the software, making it critical for users to verify their installations.

    The following groups are particularly vulnerable:

    • Users of Qlik Sense Enterprise for Windows prior to August 2023 Patch 2
    • Organizations relying on Qlik for data analytics and reporting
    • IT departments managing Qlik installations without recent updates
    • Any entities that utilize Qlik Sense in sensitive environments

    What to do

    To mitigate the risk associated with this vulnerability, it is essential to update to the latest patched versions of Qlik Sense. The fixed versions include August 2023 Patch 2 and several earlier patches dating back to November 2021.

    Immediate action is recommended to ensure the security of your systems and data.

    • Upgrade to August 2023 Patch 2 or any of the earlier patches mentioned
    • Review and validate your current Qlik Sense installations for compliance
    • Monitor for any unusual activity that may indicate exploitation attempts
    • Stay informed about future updates and security advisories from Qlik

    Original report

  2. Nov 14, 2023 · ZeroDay Catalog

    Privilege Escalation Vulnerability in Microsoft Windows DWM

    A privilege escalation vulnerability has been identified in the Microsoft Windows Desktop Window Manager, affecting Windows 10 version 1809.

    What changed

    A new vulnerability has been discovered in the Microsoft Windows Desktop Window Manager (DWM) Core Library. This issue allows for privilege escalation, which could enable an attacker to gain elevated permissions on affected systems.

    Who is affected

    This vulnerability primarily impacts users of Microsoft Windows 10 version 1809. Organizations using this version should be particularly vigilant.

    The following groups are notably affected:

    • Organizations running Windows 10 version 1809
    • Enterprise users relying on Microsoft Windows for critical operations
    • IT departments managing Windows desktop environments

    What to do

    It is crucial for affected users and organizations to assess their systems for this vulnerability. Immediate action is recommended to mitigate potential risks.

    Consider the following steps:

    • Review and apply any available security updates from Microsoft.
    • Monitor systems for unusual activity that may indicate exploitation attempts.
    • Implement strict access controls to limit potential damage from privilege escalation.

    Original report