Remove 2020 Remove Authentication Remove Blog Remove Malware
article thumbnail

CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability

Tenable

On February 7, researchers at Fortinet published a blog post highlighting the exploitation of CVE-2022-42475 and CVE-2023-27997 by Chinese threat groups including Volt Typhoon , APT15 (also known as Ke3chang) and APT31 (also known as ZIRCONIUM) as well as UNC757 ( also known as Fox Kitten), which has a “suspected nexus to the Iranian government.”

Malware 121
article thumbnail

CVE-2021-22893: Zero-Day Vulnerability in Pulse Connect Secure Exploited in the Wild

Tenable

In addition to the advisory, Pulse Secure also published a blog post detailing observed exploit behavior related to the zero-day as well others linked to previously disclosed vulnerabilities in its Pulse Connect Secure solution. Pulse Connect Secure Authentication Bypass Vulnerability. CVE-2020-8243. Authenticated.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Trending Sources

article thumbnail

CVE-2020-12271: Zero-Day SQL Injection Vulnerability in Sophos XG Firewall Exploited in the Wild

Tenable

CVE-2020-12271 is a pre-authentication SQL injection vulnerability that exists in the Sophos XG Firewall/Sophos Firewall Operating System (SFOS). There was no proof-of-concept (PoC) available for this vulnerability at the time this blog post was published. Further information about this vulnerability has not been made public.

Firewall 101
article thumbnail

AA23-215A: 2022's Top Routinely Exploited Vulnerabilities

Tenable

Analysis As we examined the list of 42 CVEs in the CSA, many have been featured in past blogs and alerts from Tenable Research as well as included in our 2020 , 2021 and 2022 TLR. This blog post was published on August 3 and reflects VPR at that time. Three of the top five vulnerabilities in the 2020 TLR were in SSL VPN devices.

article thumbnail

CVE-2021-26084: Atlassian Confluence OGNL Injection Vulnerability Exploited in the Wild

Tenable

This blog post was published on September 7 and reflects VPR at that time. Initial confusion surrounding authentication requirement. On September 2, Censys, a search engine for discovering internet devices, published a blog post analyzing the number of hosts vulnerable to CVE-2021-26084. Image Source: Censys Blog.

article thumbnail

Fighting Ransomware: Using Ivanti’s Platform to Build a Resilient Zero Trust Security Defense – Part 2

Ivanti

Within the initial blog in this series , we discussed ransomware attacks and their remediation on Android mobile devices. Often these third-party apps have not been rigorously tested for vulnerabilities and can contain malware and malicious exploits that can then take complete control of your device without you knowing.

Malware 76
article thumbnail

Nightmare Email Attacks (and Tips for Blocking Them)

Palo Alto Networks

financial services firm that relies on a widely used multi-factor authentication (MFA) mobile app to protect access to email, customer files and other sensitive data. 1, 2020, the average wire fraud attempted was $567,000 and the highest was $6 million. We provide more detail about how to handle legacy authentication below.).