ZeroDay Findings
Sign inSign up

Every 24 hours

Tech

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Nov 21, 2023

    Critical Authentication Flaw Discovered in ownCloud

    A serious vulnerability in ownCloud allows unauthorized access to files, posing significant risks for users without proper security configurations.

    What changed

    A significant vulnerability has been identified in ownCloud versions prior to 10.13.1, which allows unauthorized file access. This flaw enables attackers to manipulate files without authentication if they know the victim's username and the victim lacks a signing key.

    • Pre-signed URLs can be exploited without a signing key.
    • The vulnerability affects all users who have not configured a signing key.
    • The issue is present in versions starting from 10.6.0.

    Who is affected

    The vulnerability impacts a wide range of ownCloud users, particularly those who have not implemented necessary security measures. Organizations relying on this platform for file storage and sharing should be particularly vigilant.

    • Users of ownCloud versions before 10.13.1.
    • Organizations that utilize ownCloud for data management.
    • Any individual with files stored in ownCloud without a signing key.

    What to do

    It is crucial for users to update their ownCloud installations to the latest version to mitigate this vulnerability. Additionally, users should ensure that signing keys are configured for their accounts to enhance security.

    • Upgrade to ownCloud version 10.13.1 or later.
    • Configure signing keys for all user accounts.
    • Regularly review and update security settings in ownCloud.

  2. Nov 15, 2023

    Critical HTTP Tunneling Vulnerability Discovered in Qlik Sense

    A significant vulnerability in Qlik Sense allows unauthenticated remote code execution, posing serious risks to users who have not updated their systems.

    What changed

    A critical vulnerability has been identified in Qlik Sense that permits unauthenticated remote code execution through improper validation of HTTP headers. This flaw enables attackers to manipulate HTTP requests, potentially leading to unauthorized access and control over backend servers.

    • The vulnerability is tracked under CVE-2023-41265.
    • It affects various versions of Qlik Sense Enterprise for Windows released before August 2023 Patch 2.
    • The issue stems from an incomplete fix for a previously reported vulnerability.

    Who is affected

    Organizations using Qlik Sense Enterprise for Windows should be particularly vigilant, as they are at risk of exploitation due to this vulnerability. It is crucial for users to ensure they are operating on the latest patched versions to mitigate potential threats.

    • Qlik Sense Enterprise for Windows users prior to August 2023 Patch 2.
    • Businesses relying on Qlik for data analytics and reporting.
    • IT departments managing Qlik Sense installations across various sectors.

    What to do

    To protect against this vulnerability, users should promptly update their Qlik Sense installations to the latest patched versions. Regularly monitoring for security updates and applying them is essential to safeguard against potential exploits.

    • Upgrade to August 2023 Patch 2 or any of the previously mentioned patches.
    • Review security practices related to HTTP header validation.
    • Conduct a security audit to assess potential exposure to this vulnerability.