ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Keywords match titles. Record type separates incidents, intel, and research from CVEs.

  1. Research · Apr 3, 2025 · ZeroDay Catalog

    Critical Vulnerability in Gladinet CentreStack and Triofox Exposes Systems to Remote Code Execution

    A serious vulnerability in Gladinet CentreStack and Triofox has been identified, allowing potential remote code execution due to hard-coded cryptographic keys.

    What changed

    Gladinet CentreStack versions up to 16.1.10296.56315 are affected by a critical deserialization vulnerability stemming from the use of a hard-coded machineKey. This vulnerability has been actively exploited since March 2025, allowing attackers with knowledge of the machineKey to execute arbitrary code on the server.

    The vulnerability has been addressed in version 16.4.10315.56368, which is crucial for users to implement to mitigate risks.

    Who is affected

    Organizations utilizing Gladinet CentreStack or Triofox are at significant risk due to this vulnerability. The following groups are particularly impacted:

    Administrators and users of Gladinet CentreStack versions prior to the fixed release, as they may be susceptible to remote code execution attacks.

    • Gladinet CentreStack users (versions up to 16.1.10296.56315)
    • Triofox users relying on the same underlying technology
    • Organizations with sensitive data hosted on these platforms
    • IT security teams managing Gladinet products

    What to do

    Immediate action is required to secure affected systems. Users should upgrade to the patched version 16.4.10315.56368 to eliminate the vulnerability.

    Additionally, administrators are advised to manually delete the hard-coded machineKey from the portal's web.config file to further enhance security.

    • Upgrade Gladinet CentreStack to version 16.4.10315.56368 or later.
    • Remove the hard-coded machineKey from portal\web.config.
    • Monitor systems for any unauthorized access attempts.
    • Review security policies to ensure robust configurations are in place.

    Original report

  2. Research · Mar 19, 2025 · ZeroDay Catalog

    Malicious Code Vulnerability Discovered in reviewdog GitHub Actions

    A critical vulnerability has been identified in the reviewdog GitHub Actions, allowing the exposure of sensitive information through embedded malicious code.

    What changed

    A significant security vulnerability has been detected in the reviewdog/action-setup GitHub Action. On March 11, 2025, the action was compromised, leading to the injection of malicious code that can dump sensitive secrets into GitHub Actions Workflow Logs.

    This vulnerability affects not only the compromised action but also other related reviewdog actions, regardless of their version or pinning methods.

    Who is affected

    The vulnerability impacts various users and products associated with reviewdog GitHub Actions. Organizations utilizing these actions should be particularly vigilant.

    The following products and actions are affected by this vulnerability:

    • reviewdog/action-setup
    • reviewdog/action-shellcheck
    • reviewdog/action-composite-template
    • reviewdog/action-staticcheck

    What to do

    Organizations using the affected reviewdog actions should take immediate action to mitigate risks. It is crucial to review workflows and logs for any exposed secrets.

    Consider the following steps to enhance security:

    • Remove or disable the affected actions from workflows until a patch is available.
    • Audit GitHub Actions Workflow Logs for any unauthorized access or data exposure.
    • Implement additional security measures, such as secret scanning and monitoring for unusual activity.

    Original report