ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Dec 11, 2023 · ZeroDay Catalog

    Critical OS Command Injection Vulnerability in QNAP VioStor NVR

    A significant OS command injection vulnerability has been identified in legacy QNAP VioStor NVR models, requiring immediate attention from affected users.

    What changed

    An OS command injection vulnerability has been discovered in legacy QNAP VioStor NVR models that utilize QVR Firmware 4.x. This flaw allows authenticated users to execute arbitrary commands over the network, posing a serious security risk.

    QNAP has addressed this vulnerability in QVR Firmware version 5.0.0 and later, making it crucial for users to update their systems promptly.

    Who is affected

    The vulnerability impacts several groups and products, particularly those utilizing outdated firmware versions.

    Affected parties include:

    • Users of legacy QNAP VioStor NVR models running QVR Firmware 4.x.
    • Organizations relying on QNAP for video surveillance solutions.
    • IT administrators managing QNAP devices within their networks.
    • Any entities that have not yet upgraded to QVR Firmware 5.0.0 or later.

    What to do

    To mitigate the risks associated with this vulnerability, immediate action is recommended.

    Users should ensure they upgrade to QVR Firmware version 5.0.0 or later to protect their systems from potential exploitation.

    • Review current firmware versions on all QNAP VioStor NVR devices.
    • Implement the firmware upgrade to the latest version as soon as possible.
    • Monitor network activity for any unauthorized command executions.
    • Consider additional security measures, such as network segmentation and access controls.

    Original report

  2. Nov 9, 2023 · ZeroDay Catalog

    Critical Path Traversal Vulnerability in SysAid Server

    A significant path traversal vulnerability has been identified in SysAid Server, allowing potential code execution through file manipulation.

    What changed

    A path traversal vulnerability has been discovered in SysAid On-Premise versions prior to 23.3.36. This flaw allows attackers to write files to the Tomcat webroot, which can lead to unauthorized code execution.

    The vulnerability has been actively exploited in the wild since November 2023, highlighting the urgency for affected users to take immediate action.

    Who is affected

    Organizations using SysAid On-Premise versions earlier than 23.3.36 are at risk due to this vulnerability. The following groups should be particularly vigilant:

    IT departments managing SysAid installations, security teams monitoring for potential breaches, and any users relying on SysAid for IT service management.

    • SysAid On-Premise users prior to version 23.3.36
    • IT departments utilizing SysAid for service management
    • Organizations with exposed web applications relying on Tomcat

    What to do

    It is critical for affected organizations to upgrade their SysAid installations to version 23.3.36 or later immediately. This update addresses the path traversal vulnerability and mitigates the risk of exploitation.

    Additionally, security teams should conduct a thorough review of logs and access patterns to identify any unauthorized activity that may have occurred due to this vulnerability.

    • Upgrade to SysAid On-Premise version 23.3.36 or later
    • Review security logs for suspicious activity
    • Implement additional security measures to protect web applications

    Original report