SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
Metasploit Module – Freefloat FTP Server APPE Command Overflow
CVE Research
Microsoft’s October 2021 Patch Tuesday Squashes 4 Zero-days and a Total of 81 Vulnerabilities
Microsoft has released October Patch Tuesday security updates with a total of 81 vulnerabilities, which include Four Zero-Days, Three CVEs rated as critical, and 70 rated as important by a vulnerability scanning tool. The products covered in October’s security update include Microsoft Office, Window...
CVE Research
Pandora Ransomware Hits Toyota’s Automotive Supplier Denso
A Pandora ransomware attack targeted Denso Corp, a supplier of Toyota Motor Corporation. The confirmation came after the Pandora Ransomware group leaked the stolen data and claimed responsibility. However, the attack has not resulted in any disruption in Denso’s operations. This is why it is essenti...
CVE Research
SonicWall Zero-Day Vulnerability Is Being Exploited in the Wild
The Sonicwall Zero day Attack. NCC Group recently reported that an active zero-day SonicWall SMA 100 zero-day vulnerability being exploited in the wild. Sonicwall commented that it affects the SMA 100 series (SMA 200, SMA 210, SMA 400, SMA 410, SMA 500v) line of remote access appliances. However, bo...
CVE Research
Beware : NXNSAttack on DNS Servers Could Bring Down Major Sections of the Internet
A new vulnerability in the architecture of the global Domain Name System (DNS) was brought to light. By a team of Israeli researchers. The team also published a paper highlighting how this flaw could be leveraged with an attack. Dubbed as NXNSAttack to bring down target websites. A vulnerability man...
CVE Research
Vulnerability Scanning Software: Inspections of Your Endpoints’ Infections
Every security admins’ nightmare is detecting the vulnerabilities lurking within the network. Whether its potentially dangerous malware to hidden backdoor programs with the systems, it is important to discover these vulnerabilities and remediate them using vulnerability management tool. But to carry...
CVE Research
Google Fixes First Zero-Day Chrome vulnerability of 2024
On January 16, 2024, Google released a security patch to address CVE-2024-0519 an out-of-bound security vulnerability exploited in ongoing attacks . This patch specifically targets and fixes the first zero-day vulnerability discovered in the Chrome browser this year.A remote attacker can take advant...
CVE Research
A Critical Vulnerability in vm2 Allows a Remote Attacker to Break Out of the Sandbox!
vm2 is a node module for creating a real sandbox in the node. It is also the most widely used Javascript sandbox library, which receives about 17.5 million downloads each month. A critical vulnerability(CVE-2022-36067) in vm2 can enable a remote attacker to escape the sandbox and execute arbitrary c...