Remove 2022 Remove Authentication Remove Blog Remove Firewall
article thumbnail

CVE-2023-27997: Heap-Based Buffer Overflow in Fortinet FortiOS and FortiProxy SSL-VPN (XORtigate)

Tenable

Medium Analysis CVE-2023-27997 is a heap-based buffer overflow vulnerability in the secure socket layer virtual private network (SSL VPN) functionality in FortiOS and FortiProxy in Fortinet devices including its FortiGate Next Generation Firewalls (NGFW). This is reachable pre-authentication, on every SSL VPN appliance.

Firewall 102
article thumbnail

CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability

Tenable

On February 7, researchers at Fortinet published a blog post highlighting the exploitation of CVE-2022-42475 and CVE-2023-27997 by Chinese threat groups including Volt Typhoon , APT15 (also known as Ke3chang) and APT31 (also known as ZIRCONIUM) as well as UNC757 ( also known as Fox Kitten), which has a “suspected nexus to the Iranian government.”

Malware 121
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Trending Sources

article thumbnail

The need for DevSecOps in the embedded world

Xebia

In this blog post, I want to talk about what happened in other parts of the development world in terms of security and how the embedded world can learn from it. We presented this at ESCAR Europe 2022. Using the vulnerabilities found, an attacker could get root access to the BMC without any authentication.

article thumbnail

Cybersecurity Snapshot: Log4j Anniversary, CI/CD Risks, Infostealers, Email Attacks, OT Security

Tenable

Tenable found that, as of October 1, 2022: 72% of organizations remain vulnerable to Log4Shell. To get all the details, read the blog “ Are You Ready for the Next Log4Shell? And swing by Tenable’s Log4j resources page , which has links to FAQs, white papers, blogs, plugins, how-to videos, on-demand webinars and more.

article thumbnail

Attack Surface Risk, Challenges and Changes

Palo Alto Networks

While RDP is frequently used in organizations, it's often weakly authenticated and exposed to the internet, offering a host of opportunities to a potential attacker. Even as recently as 2022, we saw a significant jump in the portion of cloud issues versus on-premises issues, compared to the prior year.

article thumbnail

Cloud Security Basics: Protecting Your Web Applications

Tenable

In this blog, we explore these eight common cloud security concerns: The shared responsibility model. In some cases, a cloud provider may offer services to help mitigate the issues, such as web application firewalls (WAF). Source : Tenable, November 2022. Common web application vulnerabilities. Insecure APIs.

article thumbnail

Cybersecurity Snapshot: If Recession Hits, Infosec Teams Expected to Suffer the Fewest Job Losses

Tenable

conducted in December 2022. Federal Trade Commission, based on an analysis of 8,070 romance scams reported in 2022 with a dollar loss and a narrative of at least 2,000 characters.) Top payment methods on romance scams in 2022 (Source: U.S. and the U.K.