ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 25, 2023 · ZeroDay Catalog

    Critical Out-of-Bounds Write Vulnerability in VMware vCenter Server

    A serious out-of-bounds write vulnerability has been identified in VMware vCenter Server, potentially allowing remote code execution by attackers with network access.

    What changed

    VMware has disclosed an out-of-bounds write vulnerability in vCenter Server, specifically in the implementation of the DCERPC protocol. This flaw could allow an attacker with network access to exploit the vulnerability and execute arbitrary code remotely.

    • The vulnerability is categorized as critical due to its potential impact.
    • Exploitation could lead to unauthorized access and control over affected systems.
    • Immediate attention is required to mitigate risks associated with this vulnerability.

    Who is affected

    Organizations using VMware vCenter Server are at risk, particularly those with network exposure to the service. The following groups should take note:

    IT administrators and security teams managing VMware environments need to be aware of this vulnerability.

    • VMware vCenter Server users across various industries.
    • Organizations with exposed network configurations that allow access to vCenter Server.
    • Cloud service providers utilizing vCenter Server for virtualization management.

    What to do

    Organizations should assess their exposure to this vulnerability and take appropriate actions to mitigate risks. Recommended steps include:

    Implementing network segmentation to limit access to vCenter Server from untrusted networks.

    • Review and apply any available patches or updates from VMware.
    • Monitor network traffic for any suspicious activity related to vCenter Server.
    • Educate staff about the risks associated with this vulnerability and best practices for securing their environments.

    Original report

  2. Oct 18, 2023 · ZeroDay Catalog

    Critical XXE Vulnerability Found in North Grid Proself Products

    A serious XML External Entity (XXE) vulnerability has been identified in North Grid Proself products, potentially exposing sensitive account information to remote attackers.

    What changed

    North Grid has disclosed a significant vulnerability in its Proself product line, specifically an Improper Restriction of XML External Entity (XXE) Reference Vulnerability. This flaw allows remote unauthenticated attackers to exploit the system by sending specially crafted XML data, which can lead to unauthorized access to sensitive files on the server.

    • The vulnerability affects versions of Proself Enterprise/Standard Edition (Ver5.62 and earlier), Proself Gateway Edition (Ver1.65 and earlier), and Proself Mail Sanitize Edition (V
    • Attackers can potentially read arbitrary files on the server, including sensitive account information.

    Who is affected

    Organizations using North Grid Proself products are at risk due to this vulnerability. The following groups should take immediate action to mitigate potential threats.

    • Users of Proself Enterprise/Standard Edition versions 5.62 and earlier.
    • Users of Proself Gateway Edition versions 1.65 and earlier.
    • Users of Proself Mail Sanitize Edition versions 1.08 and earlier.
    • Any organization relying on these products for data management or email sanitation.

    What to do

    It is crucial for affected organizations to take immediate steps to protect their systems from potential exploitation. Users should prioritize applying the necessary updates or patches provided by North Grid.

    • Review and update to the latest versions of Proself products to mitigate the vulnerability.
    • Implement security measures to monitor for unauthorized access attempts.
    • Educate staff about the risks associated with XML External Entity attacks and the importance of secure coding practices.

    Original report