Remove 2019 Remove Authentication Remove Network Remove Operating System
article thumbnail

CVE-2024-3400: Zero-Day Vulnerability in Palo Alto Networks PAN-OS GlobalProtect Gateway Exploited in the Wild

Tenable

A critical severity command injection vulnerability in Palo Alto Networks PAN-OS has been exploited in limited targeted attacks. Palo Alto Networks reports limited exploitation in the wild According to the advisory, Palo Alto Networks confirmed that this vulnerability has been exploited in-the-wild in a “limited number of attacks.”

Network 118
article thumbnail

CVE-2018-13379, CVE-2019-5591, CVE-2020-12812: Fortinet Vulnerabilities Targeted by APT Actors

Tenable

CVE-2019-5591. Improper Authentication (FortiOS). All three vulnerabilities reside within Fortinet’s FortiOS, the operating system that underpins Fortinet’s devices. This vulnerability is a pre-authentication flaw, which means an attacker does not need to be authenticated to the vulnerable device in order to exploit it.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability

Tenable

critical infrastructure through exploitation of known vulnerabilities Background On February 8, Fortinet published an advisory (FG-IR-24-015) to address a critical flaw in FortiOS, its network operating system. CVE Description CVSSv3 Severity CVE-2024-21762 Fortinet FortiOS Out-of-bound Write Vulnerability in sslvpnd 9.6

Malware 121
article thumbnail

Microsoft’s June 2023 Patch Tuesday Addresses 70 CVEs (CVE-2023-29357)

Tenable

Critical CVE-2023-29357 | Microsoft SharePoint Server Elevation of Privilege Vulnerability CVE-2023-29357 is an EoP vulnerability in Microsoft SharePoint Server 2019 that was assigned a CVSSv3 score of 9.8 CVE-2023-32031 allows a remote, authenticated attacker to target server accounts using network calls to trigger arbitrary code execution.

Windows 98
article thumbnail

Microsoft’s October 2023 Patch Tuesday Addresses 103 CVEs (CVE-2023-36563, CVE-2023-41763)

Tenable

An unauthenticated, remote attacker could exploit this vulnerability by sending a specially crafted network call to a vulnerable Skype for Business server. Successful exploitation would result in the disclosure of sensitive information, which could be used to gain access to internal networks. and rated critical.

Windows 114
article thumbnail

Verizon Fios Quantum Gateway Routers Patched for Multiple Vulnerabilities

Tenable

Each customer is given a different Wireless network name, Wireless password, and Administrator password. The Administrator password is there for the Verizon customer to log into the router to perform various tasks that define the network. The vulnerabilities include: CVE-2019-3914 - Authenticated Remote Command Injection.

article thumbnail

CVE-2021-1609: Critical Remote Code Execution Vulnerability in Cisco Small Business VPN Routers

Tenable

While both flaws exist due to improper validation of HTTP requests and can be exploited by sending specially crafted HTTP requests, CVE-2021-1610 can only be exploited by an authenticated attacker with root privileges. In January 2019, Cisco published advisories for two different vulnerabilities in its RV320 and RV325 WAN VPN routers.