ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 18, 2023 · ZeroDay Catalog

    Critical XXE Vulnerability Found in North Grid Proself Products

    A serious XML External Entity (XXE) vulnerability has been identified in North Grid Proself products, potentially exposing sensitive account information to remote attackers.

    What changed

    North Grid has disclosed a significant vulnerability in its Proself product line, specifically an Improper Restriction of XML External Entity (XXE) Reference Vulnerability. This flaw allows remote unauthenticated attackers to exploit the system by sending specially crafted XML data, which can lead to unauthorized access to sensitive files on the server.

    • The vulnerability affects versions of Proself Enterprise/Standard Edition (Ver5.62 and earlier), Proself Gateway Edition (Ver1.65 and earlier), and Proself Mail Sanitize Edition (V
    • Attackers can potentially read arbitrary files on the server, including sensitive account information.

    Who is affected

    Organizations using North Grid Proself products are at risk due to this vulnerability. The following groups should take immediate action to mitigate potential threats.

    • Users of Proself Enterprise/Standard Edition versions 5.62 and earlier.
    • Users of Proself Gateway Edition versions 1.65 and earlier.
    • Users of Proself Mail Sanitize Edition versions 1.08 and earlier.
    • Any organization relying on these products for data management or email sanitation.

    What to do

    It is crucial for affected organizations to take immediate steps to protect their systems from potential exploitation. Users should prioritize applying the necessary updates or patches provided by North Grid.

    • Review and update to the latest versions of Proself products to mitigate the vulnerability.
    • Implement security measures to monitor for unauthorized access attempts.
    • Educate staff about the risks associated with XML External Entity attacks and the importance of secure coding practices.

    Original report

  2. Oct 16, 2023 · ZeroDay Catalog

    Cisco IOS XE Web UI Privilege Escalation Vulnerability Discovered

    Cisco has identified a critical privilege escalation vulnerability in the IOS XE Web UI, allowing attackers to gain unauthorized access and escalate privileges.

    What changed

    Cisco has reported a significant vulnerability in the web UI of Cisco IOS XE Software, which has been actively exploited by attackers. This vulnerability allows an unauthorized user to escalate privileges and gain root access.

    The investigation revealed that attackers first exploited CVE-2023-20198 to create a local user account, which was then used to elevate privileges to root, enabling full control over the affected system.

    Who is affected

    Organizations utilizing Cisco IOS XE Software are at risk due to this vulnerability. The following groups are particularly vulnerable:

    Network administrators and IT teams managing Cisco devices should be aware of the potential for exploitation.

    • Cisco IOS XE Software users
    • Enterprise networks relying on Cisco hardware
    • Organizations with exposed web UI features in their network infrastructure

    What to do

    It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Cisco has provided an update and a list of fixed releases.

    Administrators should utilize the Software Checker tool to ensure their systems are updated and secure.

    • Review and apply the latest security updates from Cisco.
    • Monitor network activity for any signs of unauthorized access.
    • Consider implementing additional security measures, such as restricting access to the web UI.

    Original report