SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Log4Shell-Critical Remote Code Execution Vulnerability in H2database Console
JFrog has recently disclosed a remote code execution vulnerability on H2 Database consoles. This is based on a Java Naming and Directory Interface(JNDI) vulnerability, and its root cause is similar to the recent Log4Shell vulnerability in Apache Log4j. H2 is an open-source RDBMS in Java that offers...
CVE Research
Apple’s March 2023 Updates Addresses Multiple Security Vulnerabilities!
Apple’s March 2023 Updates released multiple security updates in-order to patch various Apple products affected by multiple vulnerabilities. A total of 126 vulnerabilities were fixed in six of its products on March 27th. An attacker who successfully exploits these flaws could compromise the affected...
CVE Research
High-Risk Vulnerability in TeamViewer Could be Exploited to Crack Users’ Password
The discovery of a high-risk vulnerability was in TeamViewer for Windows. It has a tracking as “CVE-2020-13699“, with a CVSS base score of “8.8,” in which exploits can happen by remote attacks to crack users’ passwords and, thereupon, lead to further system exploitation. Vulnerability Management Sof...
CVE Research
Warning: Atlassian Critical Vulnerabilities Being Actively Exploited- Patch Now!
Atlassian released patches for three critical vulnerabilities (CVE-2022-26136, CVE-2022-26137, CVE-2022-26138). Out of the three flaws, two impacts Confluence Server, Confluence Data Center, and some other products, as well as Bamboo, BitBucket, Fisheye, and Jira, and one of the flaws impacts only C...
CVE Research
PwnKit Linux vulnerability Jan-2022: Local Privilege Escalation Vulnerability In Major Linux Distributions
Most of the Linux distributions have the pkexec binary. The vulnerability (CVE-2021-4034) lies in that binary. The pkexec is a part PwnKit Linux vulnerability Jan-2022, which affects the Polkit open-source application framework used for interaction between privileged and unprivileged processes. Furt...
CVE Research
WordPress Plugin Contact Form 7 Critical File Upload Vulnerability (CVE-2020-35489)
Contact Form 7 is a popular WordPress plugin that is used to create, customize, and manage multiple contact forms on WordPress sites. A critical file upload vulnerability (CVE-2020-35489) has an identity in the WordPress Contact Form 7 plugin, allowing an attacker to execute arbitrary code on affect...
CVE Research
Apple’s June 2023 Updates Addresses Multiple Security Vulnerabilities And 3 Zero-Days!
Apples Security Alert June 2023 recently released multiple updates to patch various Apple products affected by multiple vulnerabilities. A total of three vulnerabilities were fixed in nine of its products on June 21st. An attacker who successfully exploits these flaws could therefore compromise the ...
CVE Research
Cisco AnyConnect Vulnerabilities are Being Exploited in the Wild!
Cisco AnyConnect Secure Mobility Client allows users to connect to remote systems through a VPN. On October 26, 2022, Cisco issued a warning to its customers, stating that security vulnerabilities in the Cisco AnyConnect Secure Mobility Client for Windows, which are two years old, are currently bein...