ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Keywords match titles. Record type separates incidents, intel, and research from CVEs.

  1. Research · Jan 24, 2024 · ZeroDay Catalog

    Critical Path Traversal Vulnerability in Jenkins CLI

    A path traversal vulnerability in Jenkins CLI allows unauthorized access to sensitive files, posing a significant risk to Jenkins installations.

    What changed

    A newly identified vulnerability in the Jenkins Command Line Interface (CLI) allows unauthenticated attackers to exploit the system. The issue arises from the CLI command parser's failure to disable a feature that processes an '@' character followed by a file path, leading to the exposure of arbitrary file contents from the Jenkins controller file system.

    Who is affected

    The vulnerability impacts various versions of Jenkins, specifically Jenkins 2.441 and earlier, as well as LTS 2.426.2 and earlier. Organizations using these versions are at risk of unauthorized file access.

    • Jenkins users running versions 2.441 and earlier.
    • Organizations utilizing Jenkins LTS 2.426.2 and earlier.
    • Developers and DevOps teams relying on Jenkins for CI/CD pipelines.
    • Any entity that has implemented Jenkins in their software development lifecycle.

    What to do

    It is crucial for affected organizations to take immediate action to mitigate the risk posed by this vulnerability. Upgrading to the latest version of Jenkins is strongly recommended to ensure the CLI command parser is secure.

    • Upgrade Jenkins to the latest version to eliminate the vulnerability.
    • Review access controls and permissions for Jenkins installations.
    • Monitor logs for any unauthorized access attempts.
    • Implement additional security measures, such as network segmentation, to protect sensitive file systems.

    Original report

  2. Research · Jan 22, 2024 · ZeroDay Catalog

    Apple Addresses WebKit Type Confusion Vulnerability Across Multiple Products

    Apple has released updates to address a critical type confusion vulnerability in WebKit, affecting various products and potentially leading to arbitrary code execution.

    What changed

    Apple has resolved a type confusion vulnerability in WebKit that could allow maliciously crafted web content to execute arbitrary code on affected devices. This issue has been addressed with improved validation checks.

    The fix is included in several updates, including Safari 17.3 and multiple versions of iOS, iPadOS, macOS, tvOS, and visionOS.

    • Type confusion vulnerability could lead to arbitrary code execution.
    • The vulnerability was linked to the Coruna exploit.
    • Updates were released on January 22, 2024, for iOS 17.3.

    Who is affected

    The vulnerability impacts a range of Apple products, which may expose users to significant security risks if not updated promptly.

    Affected products include Safari, iOS devices, iPadOS devices, macOS systems, and tvOS.

    • Safari 17.3 and earlier versions.
    • iOS 15.8.7, 16.7.5, and 17.3.
    • iPadOS 15.8.7, 16.7.5, and 17.3.
    • macOS Monterey 12.7.3, macOS Sonoma 14.3, and macOS Ventura 13.6.4.

    What to do

    Users and administrators are strongly advised to update their devices to the latest versions to mitigate the risk associated with this vulnerability.

    Regularly check for updates and apply them promptly to ensure continued protection against potential exploits.

    • Update Safari to version 17.3 or later.
    • Upgrade iOS and iPadOS to the latest versions available.
    • Ensure macOS systems are running the latest updates.

    Original report