Zero Day Initiative

Zero Day Initiative advisories Jul 8

ZDI-26-398: (0Day) (Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentic...

T1190 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-397: X.Org Server CreateSaverWindow Use-After-Free Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server.

2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-396: X.Org Server ChangeDrawableAttributes Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server.

2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-395: X.Org Server SyncChangeCounter Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.

T1548 2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-394: X.Org Server FreeCounter Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.

T1548 2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-393: X.Org Server SetMap Request Stack-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.

T1548 2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-392: X.Org Server Xkb Key Types Stack-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.

T1548 2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-391: X.Org Server miSyncDestroyFence Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.

T1548 2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-390: X.Org Server Font Alias Stack-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.

T1548 2 IOCs

Zero Day Initiative → Details

Zero Day Initiative advisories Oracle Jun 24

ZDI-26-389: Oracle PeopleSoft ExecuteProcessActivityCommand External Control of File Path Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle PeopleSoft. Although authentication is required to e...

T1190 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Oracle Jun 24

ZDI-26-388: Oracle PeopleSoft HubMBeanPersistance Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle PeopleSoft. Although authentication is required to e...

T1190 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Oracle Jun 24

ZDI-26-387: Oracle PeopleSoft HttpListeningConnector Server-Side Request Forgery Vulnerability

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Oracle PeopleSoft. Authentication is not r...

1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-386: Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerab...

T1190 T1059 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-385: Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerab...

T1190 T1059 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-384: MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit ...

T1190 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-383: ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vul...

T1190 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-382: ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vul...

T1190 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-381: ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vul...

T1190 1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-380: ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to expl...

1 IOC

Zero Day Initiative → Details

Zero Day Initiative advisories Jun 24

ZDI-26-379: ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vul...

1 IOC

Zero Day Initiative → Details