SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
SIGRed – Microsoft Windows DNS Server RCE Vulnerability (CVE-2020-1350)
A critical and wormable 17 years-old vulnerability (CVE-2020-1350) has been discovered in Microsoft Windows DNS Servers which can allow an attacker to run arbitrary code on the vulnerable system. The vulnerability is identified as CVE-2020-1350 and resides in the way how DNS Server parses incoming q...
CVE Research
5 Steps to Build an Effective Vulnerability Management Program
Vulnerability management program is a standardized process across most organizations. However, even organizations that follow periodic compliance audits and patch software vulnerabilities are hit by cyber-attacks. If attack surfaces are open despite following a documented vulnerability management pr...
CVE Research
Text4Shell: Critical Code Execution in Apache Common Text Library – Patch Now!
Apache Common Text is used for advance text handling functions such as escaping special characters and the similarity of strings (basis on Cosine, Hamming, Longest Commons Subsequence distance, etc.). The difference between strings, text lookup, etc. A code execution vulnerability( CVE-2022-42889 )i...
CVE Research
CVE-2013-5400: Analysis Of Authentication Bypass Vulnerability in IBM Platform Symphony
IBM Platform Symphony Developer Edition is a free software to develop and test High-performance computing (HPC) and Grid Computing SDK, which pool out your technical computing resources to run big data and/or compute-intensive problems. CVE-2013-5400 is an authentication bypass vulnerability in IBM ...
CVE Research
Vulnerability Management Program Metrics: How do you Measure its Success?
Ponemon Institute notes that around 60% of breaches could have been easily avoided if organizations had included a vulnerability management software to protect devices. Thousands of vulnerabilities in the cybersecurity space are discovered every year. Even a small failure to discover vulnerabilities...
CVE Research
Arcadyan-Based Routers and Modems Under Active Exploitation
Millions of routers are exposed to a security flaw that existed for a decade in home routers with Arcadyan firmware. This actively exploited flaw tracked under CVE identifier CVE-2021-20090 has found its way into routers provided by at least 20 models across 17 different vendors and 11 countries. A ...