ZeroDay Findings
Sign inSign up

Every 24 hours

Tech

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

Filter by vulnerability, fix, incident, intel, or research.

  1. Research · Nov 29, 2023

    Critical Integer Overflow Vulnerability Discovered in Google Skia

    A newly identified integer overflow vulnerability in Google Skia could allow remote attackers to escape the sandbox, posing a significant risk to various Google products.

    What changed

    A serious integer overflow vulnerability has been discovered in Google Skia, which is integral to several Google products. This flaw could enable attackers to compromise the renderer process and potentially escape the sandbox, leading to unauthorized access.

    Who is affected

    The vulnerability impacts a range of Google products, making it critical for users and organizations to be aware of the risks involved.

    Affected products include:

    • Google Chrome
    • ChromeOS
    • Android
    • Flutter

    What to do

    Users and organizations should prioritize updating their affected Google products to mitigate the risks associated with this vulnerability. Regular security audits and monitoring for unusual activity are also recommended.

  2. Research · Nov 21, 2023

    Critical Authentication Flaw Discovered in ownCloud

    A serious vulnerability in ownCloud allows unauthorized access to files, posing significant risks for users without proper security configurations.

    What changed

    A significant vulnerability has been identified in ownCloud versions prior to 10.13.1, which allows unauthorized file access. This flaw enables attackers to manipulate files without authentication if they know the victim's username and the victim lacks a signing key.

    • Pre-signed URLs can be exploited without a signing key.
    • The vulnerability affects all users who have not configured a signing key.
    • The issue is present in versions starting from 10.6.0.

    Who is affected

    The vulnerability impacts a wide range of ownCloud users, particularly those who have not implemented necessary security measures. Organizations relying on this platform for file storage and sharing should be particularly vigilant.

    • Users of ownCloud versions before 10.13.1.
    • Organizations that utilize ownCloud for data management.
    • Any individual with files stored in ownCloud without a signing key.

    What to do

    It is crucial for users to update their ownCloud installations to the latest version to mitigate this vulnerability. Additionally, users should ensure that signing keys are configured for their accounts to enhance security.

    • Upgrade to ownCloud version 10.13.1 or later.
    • Configure signing keys for all user accounts.
    • Regularly review and update security settings in ownCloud.