SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Google Chrome Zero-Days Under Active Exploitation
Google has released a security advisory for its Chrome users on Windows, Mac, and Linux, addressing seven security vulnerabilities. However, this release is including two very critical Zero-Day exploits exploited in the wild. Hence, these google chrome security vulnerabilities are tracking as CVE-20...
CVE Research
Critical Jenkins Vulnerability can Cause Memory Corruption and Disclose Sensitive Information
Jenkins, an open-source automation server software released an advisory pertaining to a critical vulnerability present in its application. Jenkins enables developers to build, test, and deploy applications. This vulnerability tracked as CVE-2019-17638 using a vulnerability scanning tool when exploi...
CVE Research
Google Has Released a Fix For High-Severity RCE Vulnerability in Chrome Browser
Google has released a new version 90 to fix high severity vulnerability in the V8 Javascript component of Google Chrome. Google Chrome RCE Vulnerability is tracked as CVE-2021-21227 is an insufficient data validation vulnerability. Successful exploitation of the vulnerability allows remote attackers...
CVE Research
Intel Addresses 3 High Severity Vulnerabilities in BIOS of Several Processors
Intel has recently disclosed a short advisory with details of high severity for 3 CVEs here. They are CVE-2021-0157, CVE-2021-0158, and CVE-2021-0146. The first two are related to BIOS firmware-based vulnerabilities. Once the attacker accesses the BIOS firmware settings, they can exploit the weaknes...
CVE Research
A Critical Vulnerability in Atlassian Confluence Server Under Active Exploitation
Atlassian Confluence recently published a security advisory to patch a critical OGNL(Object-Graph Navigation Language) injection vulnerability existing in Confluence Server and Data Center instance. This vulnerability allowed authenticated and, in some instances, even unauthenticated users to execu...
CVE Research
3 Years of WannaCry: Millions of Endpoints Are Still Vulnerable Out There!
Are you aware of the worst cyberattack of 2017, the WannaCry ransomware attack? WannaCry was one of the worst-hit ransomware attacks that surfaced around May 2017 in Asia. The malware spread like wildfire and infected more than 230,000 computers in a day. The WannaCry attack mainly affected the Wind...
CVE Research
Mozilla Fixes Critical Vulnerability In Cryptographic Libraries
Mozilla has recently fixed a critical memory corruption vulnerability using their vulnerability manager. This was affecting its cross-platform Network Security Services (NSS) set of cryptographic libraries. Companies like AOL, Red Hat, and Google, as well as other organizations, use Network Securit...
CVE Research
Discourse Patches Critical Remote Code Execution Vulnerability
Discourse is one of the most popular open-source community forums and mailing list management software applications. A critical code execution vulnerability (CVE-2021-41163) identifies in Discourse, allows an attacker to execute arbitrary code on the affected system. This vulnerability recognizes wi...
CVE Research
Your Key to Good Security Posture: Security Vulnerability Management
Cybercriminals are always looking for security weaknesses to steal sensitive and confidential information. Especially in software development environments, IT security admins come across unexpected software flaws which might be potentially dangerous to the organizations. Therefore, IT security admin...