ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Jan 21, 2024 · ZeroDay Catalog

    Critical Path Traversal Vulnerability in D-Link DIR-859 Router

    A critical path traversal vulnerability has been identified in the D-Link DIR-859 router, affecting unsupported firmware versions.

    What changed

    A critical vulnerability has been discovered in the D-Link DIR-859 router, specifically in version 1.06B01. This vulnerability allows for path traversal through the manipulation of the HTTP POST request to the /hedwig.cgi component.

    The vulnerability can be exploited remotely, posing significant risks to affected devices.

    • Vulnerability identifier: VDB-251666
    • Exploitable via crafted HTTP requests
    • Publicly disclosed, increasing risk of exploitation

    Who is affected

    The vulnerability primarily impacts users of the D-Link DIR-859 router who are operating on the specified unsupported firmware version.

    Users of this device should be aware that the vendor no longer provides support or updates, leaving them vulnerable.

    • D-Link DIR-859 router with firmware version 1.06B01
    • Home users relying on this router for network connectivity
    • Small businesses utilizing this router for operational purposes

    What to do

    Given the critical nature of this vulnerability, affected users are strongly advised to take immediate action to mitigate risks.

    Consider replacing the device with a supported model or implementing network segmentation to limit exposure.

    • Evaluate the need for upgrading to a newer, supported router model
    • Implement firewall rules to restrict access to the affected device
    • Monitor network traffic for unusual activity related to this vulnerability

    Original report

  2. Jan 2, 2024 · ZeroDay Catalog

    Command Injection Vulnerability in tj-actions/changed-files

    A command injection vulnerability has been identified in tj-actions/changed-files, allowing potential execution of arbitrary code through manipulated filenames.

    What changed

    A vulnerability has been discovered in the tj-actions/changed-files GitHub Action, which allows for command injection through output filenames. This flaw can enable an attacker to execute arbitrary code and may lead to the exposure of sensitive information.

    The issue arises from the action's handling of filenames, which are not adequately sanitized beyond JSON escaping. This oversight can be exploited to include special characters that could trigger command execution.

    Who is affected

    Users of the tj-actions/changed-files GitHub Action are at risk due to this vulnerability. The following groups are particularly affected:

    Developers utilizing GitHub Actions for CI/CD pipelines may inadvertently expose their workflows to this risk.

    • Organizations using tj-actions/changed-files for tracking file changes in commits or pull requests.
    • Developers who rely on automated workflows that incorporate this action.
    • Security teams monitoring GitHub Actions for vulnerabilities in their CI/CD processes.

    What to do

    It is crucial for users of tj-actions/changed-files to review their workflows and assess the potential impact of this vulnerability. Immediate action is recommended to mitigate risks.

    Consider disabling the action or implementing additional input validation to prevent command injection. Regularly monitor for updates or patches from the maintainers of tj-actions.

    • Review and update workflows that utilize tj-actions/changed-files.
    • Implement strict input validation to sanitize filenames.
    • Stay informed about updates from tj-actions regarding this vulnerability.

    Original report