ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Nov 14, 2023 · ZeroDay Catalog

    Privilege Escalation Vulnerability in Microsoft Windows DWM

    A privilege escalation vulnerability has been identified in the Microsoft Windows Desktop Window Manager, affecting Windows 10 version 1809.

    What changed

    A new vulnerability has been discovered in the Microsoft Windows Desktop Window Manager (DWM) Core Library. This issue allows for privilege escalation, which could enable an attacker to gain elevated permissions on affected systems.

    Who is affected

    This vulnerability primarily impacts users of Microsoft Windows 10 version 1809. Organizations using this version should be particularly vigilant.

    The following groups are notably affected:

    • Organizations running Windows 10 version 1809
    • Enterprise users relying on Microsoft Windows for critical operations
    • IT departments managing Windows desktop environments

    What to do

    It is crucial for affected users and organizations to assess their systems for this vulnerability. Immediate action is recommended to mitigate potential risks.

    Consider the following steps:

    • Review and apply any available security updates from Microsoft.
    • Monitor systems for unusual activity that may indicate exploitation attempts.
    • Implement strict access controls to limit potential damage from privilege escalation.

    Original report

  2. Nov 9, 2023 · ZeroDay Catalog

    Critical Path Traversal Vulnerability in SysAid Server

    A significant path traversal vulnerability has been identified in SysAid Server, allowing potential code execution through file manipulation.

    What changed

    A path traversal vulnerability has been discovered in SysAid On-Premise versions prior to 23.3.36. This flaw allows attackers to write files to the Tomcat webroot, which can lead to unauthorized code execution.

    The vulnerability has been actively exploited in the wild since November 2023, highlighting the urgency for affected users to take immediate action.

    Who is affected

    Organizations using SysAid On-Premise versions earlier than 23.3.36 are at risk due to this vulnerability. The following groups should be particularly vigilant:

    IT departments managing SysAid installations, security teams monitoring for potential breaches, and any users relying on SysAid for IT service management.

    • SysAid On-Premise users prior to version 23.3.36
    • IT departments utilizing SysAid for service management
    • Organizations with exposed web applications relying on Tomcat

    What to do

    It is critical for affected organizations to upgrade their SysAid installations to version 23.3.36 or later immediately. This update addresses the path traversal vulnerability and mitigates the risk of exploitation.

    Additionally, security teams should conduct a thorough review of logs and access patterns to identify any unauthorized activity that may have occurred due to this vulnerability.

    • Upgrade to SysAid On-Premise version 23.3.36 or later
    • Review security logs for suspicious activity
    • Implement additional security measures to protect web applications

    Original report