ZeroDay Findings
Sign inSign up

Every 24 hours

Tech

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Mar 28, 2024

    Critical Vulnerability in Serverpod Client Exposes Users to Man-in-the-Middle Attacks

    A significant vulnerability in the Serverpod client allows for the acceptance of any TLS certificate, posing serious security risks.

    What changed

    The Serverpod client has a critical flaw that permits the acceptance of any TLS certificate, effectively bypassing the necessary validation. This vulnerability affects all non-web HTTP clients within the package, making encrypted communications susceptible to interception.

    • Bypassing TLS certificate validation can lead to man-in-the-middle attacks.
    • Attackers can hijack connections between the client device and the server.
    • All versions of the affected package are at risk until patched.

    Who is affected

    The vulnerability impacts a range of users and systems that rely on the Serverpod client for secure communications. The following groups are particularly at risk:

    • Developers utilizing the Serverpod client in their applications.
    • Organizations that implement Serverpod for data transmission.
    • End-users who rely on applications built with the Serverpod client.

    What to do

    To mitigate the risks associated with this vulnerability, it is crucial for users to take immediate action. The recommended course of action is to upgrade to the latest version of the Serverpod client.

    • Upgrade to the patched version of the Serverpod client as soon as possible.
    • Review application configurations to ensure secure communication practices.
    • Monitor network traffic for any suspicious activity that may indicate an ongoing attack.

  2. Jan 22, 2024

    Apple Addresses WebKit Type Confusion Vulnerability Across Multiple Products

    Apple has released critical updates to address a type confusion vulnerability in WebKit, impacting several of its products and potentially leading to arbitrary code execution.

    What changed

    Apple has resolved a significant type confusion vulnerability in WebKit that could allow maliciously crafted web content to execute arbitrary code. This issue has been addressed through improved checks and is included in several recent updates.

    The fix was rolled out in Safari 17.3 and various versions of iOS, iPadOS, macOS, tvOS, and visionOS, ensuring a wide range of devices are protected.

    Who is affected

    The vulnerability affects a variety of Apple products, impacting both users and developers relying on these platforms for secure web browsing.

    Specifically, the following are affected:

    • Safari browser across multiple versions
    • iOS devices running versions 15.8.7, 16.7.5, and 17.3
    • iPadOS versions 15.8.7, 16.7.5, and 17.3
    • macOS versions Monterey 12.7.3, Sonoma 14.3, and Ventura 13.6.4

    What to do

    Users are strongly encouraged to update their devices to the latest versions to mitigate the risks associated with this vulnerability. Regularly applying updates is crucial for maintaining security.

    For those unable to upgrade to the latest iOS version, the updates that include the fix are available for download.