ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Nov 21, 2023 · ZeroDay Catalog

    Information Disclosure Vulnerability in ownCloud GraphAPI

    A significant information disclosure vulnerability has been identified in the ownCloud GraphAPI, affecting multiple versions and potentially exposing sensitive configuration details.

    What changed

    An information disclosure vulnerability has been discovered in the ownCloud GraphAPI, specifically in versions 0.2.x prior to 0.2.1 and 0.3.x prior to 0.3.1. The vulnerability arises from the use of a third-party library, GetPhpInfo.php, which, when accessed, reveals sensitive configuration details of the PHP environment.

    This exposure includes critical environment variables that may contain sensitive information such as admin passwords, mail server credentials, and license keys, particularly in containerized deployments.

    Who is affected

    The vulnerability impacts users of the ownCloud platform utilizing the affected versions of the GraphAPI app. Organizations relying on ownCloud for file sharing and collaboration should be particularly vigilant.

    Additionally, any deployments that utilize containerization may be at greater risk due to the potential exposure of sensitive environment variables.

    • ownCloud users with versions 0.2.x before 0.2.1
    • ownCloud users with versions 0.3.x before 0.3.1
    • Organizations using containerized deployments of ownCloud
    • Developers integrating the GraphAPI into their applications

    What to do

    To mitigate this vulnerability, it is crucial for affected users to upgrade to the latest versions of the ownCloud GraphAPI. Version 0.2.1 or later for the 0.2.x series and version 0.3.1 or later for the 0.3.x series should be implemented immediately.

    Additionally, review and restrict access to the GetPhpInfo.php library to prevent unauthorized access to sensitive information.

    • Upgrade to ownCloud GraphAPI version 0.2.1 or later
    • Upgrade to ownCloud GraphAPI version 0.3.1 or later
    • Restrict access to the GetPhpInfo.php library
    • Conduct a security audit to identify any exposed sensitive information

    Original report

  2. Nov 15, 2023 · ZeroDay Catalog

    Critical Vulnerability in Qlik Sense Allows Remote Code Execution

    A newly discovered vulnerability in Qlik Sense could allow unauthenticated remote code execution, impacting multiple versions of the software.

    What changed

    A significant vulnerability has been identified in Qlik Sense Enterprise for Windows, allowing attackers to execute unauthorized HTTP requests on the backend server. This issue arises from improper validation of HTTP headers, enabling privilege escalation through HTTP tunneling.

    The vulnerability, cataloged as CVE-2023-41265, affects versions of Qlik Sense prior to the August 2023 Patch 2. It is crucial for users to understand the implications of this flaw and take immediate action to secure their systems.

    Who is affected

    Organizations using Qlik Sense Enterprise for Windows are at risk if they have not applied the necessary patches. The vulnerability impacts various versions of the software, making it critical for users to verify their installations.

    The following groups are particularly vulnerable:

    • Users of Qlik Sense Enterprise for Windows prior to August 2023 Patch 2
    • Organizations relying on Qlik for data analytics and reporting
    • IT departments managing Qlik installations without recent updates
    • Any entities that utilize Qlik Sense in sensitive environments

    What to do

    To mitigate the risk associated with this vulnerability, it is essential to update to the latest patched versions of Qlik Sense. The fixed versions include August 2023 Patch 2 and several earlier patches dating back to November 2021.

    Immediate action is recommended to ensure the security of your systems and data.

    • Upgrade to August 2023 Patch 2 or any of the earlier patches mentioned
    • Review and validate your current Qlik Sense installations for compliance
    • Monitor for any unusual activity that may indicate exploitation attempts
    • Stay informed about future updates and security advisories from Qlik

    Original report