SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Vulnerability Management Program Metrics: How do you Measure its Success?
Ponemon Institute notes that around 60% of breaches could have been easily avoided if organizations had included a vulnerability management software to protect devices. Thousands of vulnerabilities in the cybersecurity space are discovered every year. Even a small failure to discover vulnerabilities...
CVE Research
Arcadyan-Based Routers and Modems Under Active Exploitation
Millions of routers are exposed to a security flaw that existed for a decade in home routers with Arcadyan firmware. This actively exploited flaw tracked under CVE identifier CVE-2021-20090 has found its way into routers provided by at least 20 models across 17 different vendors and 11 countries. A ...
CVE Research
Google patches new Chrome zero-day flaw exploited in Wild
Google has released security fixes for the desktop Chrome app on Windows, Linux, and Mac. This consists of Ten vulnerabilities that include one Zero-day vulnerability with High severity. Google can fix the vulnerabilities by auto patching. This is the fifth Zero-day vulnerability fixed by Google thi...
CVE Research
Follina: Microsoft Support Diagnostic Tool RCE Vulnerability Under Active Exploitation
A remote code execution vulnerability was discovered in MSDT (Microsoft Support Diagnostic Tool), which is tracked with CVE-2022-30190. Vulnerability exploitation is active in the wild. MSDT is a Windows 11/10/8.1/7 and Windows Server service. Microsoft support personnel can use the tool to evaluate...
CVE Research
Why Is It Important To Manage Vulnerabilities Beyond CVEs?
CVE stands for Common Vulnerabilities and Exposures. It is the database of publicly disclosed information on security issues. All organizations use CVEs to identify and track the number of vulnerabilities. However, not all the vulnerabilities discovered have a CVE number. For instance, the CVE datab...
CVE Research
ALERT: SQLite database Remote Code Execution Vulnerability
SQLite is a cross-platform relational database management system. It is known to be the most used database engine in the world. The vendor claims that several applications, like Skype, Firefox, Chrome, Safari, etc., use billions of deployments of SQLite. Researchers showcased how SQL language can ex...
CVE Research
F5 BIG-IP Critical Remote Code Execution Vulnerability Getting Exploited. Patch Now!
A Remote Code Execution vulnerability was detected (CVE-2022-1388) in F5 BIG-IP. This flaw affects the BIG-IP iControl REST authentication component. Successful exploitation allows remote attackers to bypass authentication and execute commands on the vulnerable device with the highest privileges. Va...