ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Mar 28, 2024 · ZeroDay Catalog

    Critical Vulnerability in Serverpod Client Allows Certificate Validation Bypass

    A significant vulnerability in the Serverpod client allows for the bypass of TLS certificate validation, exposing users to potential man-in-the-middle attacks.

    What changed

    The Serverpod client has been found to accept any TLS certificate, effectively bypassing the validation process. This flaw affects all non-web HTTP clients within the package, which can lead to serious security implications.

    The vulnerability enables an attacker to intercept and hijack encrypted traffic between the client device and the server, posing a risk to data integrity and confidentiality.

    Who is affected

    All users of the Serverpod client are at risk due to this vulnerability. The issue spans across all versions of the client, making it critical for users to take immediate action.

    Organizations relying on Serverpod for secure communications should be particularly vigilant, as the flaw can compromise sensitive data.

    • Users of the Serverpod client across various platforms.
    • Developers integrating Serverpod into their applications.
    • Organizations utilizing Serverpod for secure data transmission.

    What to do

    It is imperative for users to upgrade to the latest version of the Serverpod client, which addresses this vulnerability and restores proper TLS certificate validation.

    Regularly monitor security advisories and apply patches promptly to mitigate risks associated with similar vulnerabilities in the future.

    • Upgrade to the latest version of the Serverpod client immediately.
    • Implement additional security measures to monitor traffic for potential man-in-the-middle attacks.
    • Stay informed about updates and patches related to Serverpod and similar software.

    Original report

  2. Feb 26, 2024 · ZeroDay Catalog

    Critical Path Traversal Vulnerability in ConnectWise ScreenConnect

    A path traversal vulnerability has been identified in ConnectWise ScreenConnect, potentially allowing remote code execution and data exposure.

    What changed

    A significant vulnerability has been discovered in ConnectWise ScreenConnect versions 23.9.7 and earlier. This path traversal flaw could enable attackers to exploit the system, leading to unauthorized remote code execution or exposure of sensitive data.

    Who is affected

    Organizations utilizing ConnectWise ScreenConnect for remote support and management are at risk. This vulnerability could impact various sectors that rely on remote access tools for operational efficiency.

    • ConnectWise ScreenConnect users across multiple industries.
    • IT service providers leveraging ScreenConnect for client support.
    • Businesses with critical systems managed through ScreenConnect.
    • Any organization that prioritizes remote access solutions.

    What to do

    It is crucial for affected users to assess their current version of ConnectWise ScreenConnect and take immediate action to mitigate risks. Updating to the latest version is strongly recommended to protect against potential exploitation.

    • Upgrade to the latest version of ConnectWise ScreenConnect.
    • Review access controls and permissions related to remote access.
    • Monitor systems for any unusual activity that may indicate exploitation.
    • Stay informed about further updates from ConnectWise regarding this vulnerability.

    Original report