ZeroDay Findings
Sign inSign up

Every 24 hours

Tech

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Mar 4, 2025

    VMware ESXi Faces Critical Arbitrary Write Vulnerability

    VMware ESXi has been identified with a significant arbitrary write vulnerability that could allow attackers to escape the sandbox environment.

    What changed

    An arbitrary write vulnerability has been discovered in VMware ESXi, which poses a serious risk to the integrity of virtual machines. This flaw allows attackers with certain privileges to execute arbitrary kernel writes, potentially leading to a sandbox escape.

    Who is affected

    This vulnerability primarily affects users and organizations utilizing VMware ESXi for virtualization. The implications of this security flaw could impact a wide range of sectors that rely on virtualized environments.

    • VMware ESXi users across various industries.
    • Organizations utilizing virtual machines for critical applications.
    • IT departments responsible for maintaining virtual infrastructures.
    • Service providers offering cloud solutions based on VMware technologies.

    What to do

    Organizations should assess their current VMware ESXi deployments and prioritize patching to mitigate the risks associated with this vulnerability. Implementing strict access controls and monitoring can also help reduce the potential attack surface.

    • Review and apply security patches provided by VMware.
    • Limit privileges for users accessing the VMX process.
    • Monitor for unusual activities within the virtual environment.
    • Consider conducting a security audit of the virtual infrastructure.

  2. Oct 29, 2024

    Critical Vulnerability in CyberPanel Allows Remote Command Execution

    A significant vulnerability in CyberPanel has been identified, enabling remote attackers to execute arbitrary commands due to incorrect default permissions.

    What changed

    A flaw in CyberPanel's handling of permissions has been discovered, specifically in the upgrademysqlstatus function within databases/views.py. This vulnerability allows attackers to bypass authentication mechanisms, leading to potential remote command execution.

    The issue arises from the secMiddleware being ineffective for certain requests, enabling exploitation through crafted input.

    Who is affected

    The vulnerability impacts various users and organizations utilizing CyberPanel, particularly those running versions up to 2.3.6 and the unpatched 2.3.7.

    As this flaw has been actively exploited since October 2024, it poses a significant risk to those who have not yet updated their installations.

    • CyberPanel users running affected versions.
    • Web hosting providers utilizing CyberPanel for client management.
    • Developers and system administrators managing databases through CyberPanel.

    What to do

    It is crucial for affected users to take immediate action to mitigate the risks associated with this vulnerability. Updating to the latest version of CyberPanel is highly recommended.

    Additionally, organizations should review their security policies and consider implementing additional layers of security to protect against potential exploitation.

    • Upgrade CyberPanel to the latest version to patch the vulnerability.
    • Review and tighten access controls and permissions within the application.
    • Monitor systems for any signs of unauthorized access or exploitation.