article thumbnail

CVE-2020-12271: Zero-Day SQL Injection Vulnerability in Sophos XG Firewall Exploited in the Wild

Tenable

Sophos pushes a hotfix to address a SQL injection vulnerability in Sophos XG Firewall that was exploited in the wild. On April 22, Sophos published a knowledge base entry on the Sophos Community regarding the discovery of a zero-day vulnerability in the Sophos XG Firewall that was exploited in the wild. Background. Proof of concept.

Firewall 101
article thumbnail

How to minimize remote access cyber security threats in 2024

CIO

These companies heavily rely on remote access services, which can be a significant attack vector due to insecure servers, inadequate security protocols, cloud misconfigurations, exposure of security infrastructure (such as routers and firewalls), and more. Change your vulnerability mindset to identify legacy vulnerability management systems.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Trending Sources

article thumbnail

CVE-2024-3400: Zero-Day Vulnerability in Palo Alto Networks PAN-OS GlobalProtect Gateway Exploited in the Wild

Tenable

Background On April 12, Palo Alto Networks released a security advisory for a critical command injection vulnerability affecting PAN-OS, the custom operating system (OS) Palo Alto Networks (PAN) uses in their next-generation firewalls. According to the advisory, this vulnerability impacts PAN-OS versions 10.2,

Network 118
article thumbnail

Why you must extend Zero Trust to public cloud workloads

CIO

It’s not as simple as just extending traditional firewall capabilities to the cloud. With Zscaler Workload Communications, organizations can effortlessly shift from traditional perimeter-based approaches to a zero-trust framework and establish granular control, strong authentication, and continuous monitoring.

Cloud 321
article thumbnail

Optimizing PCI compliance in financial institutions

CIO

All other needs, for example, authentication, encryption, log management, system configuration, would be treated the same—by using the architectural patterns available. Some of them not only can provide strong authentication, but also have the ability to be used as a secret repository. However, a CCA simplifies this process.

article thumbnail

CVE-2023-27997: Heap-Based Buffer Overflow in Fortinet FortiOS and FortiProxy SSL-VPN (XORtigate)

Tenable

Medium Analysis CVE-2023-27997 is a heap-based buffer overflow vulnerability in the secure socket layer virtual private network (SSL VPN) functionality in FortiOS and FortiProxy in Fortinet devices including its FortiGate Next Generation Firewalls (NGFW). This is reachable pre-authentication, on every SSL VPN appliance. 6.4.10, 6.4.12

Firewall 102
article thumbnail

CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability

Tenable

Fortinet reports “potential” exploitation in the wild In its advisory on February 8, Fortinet said this vulnerability is “potentially being exploited in the wild.” It has not shared any specifics about in-the-wild exploitation, nor has it shared any information about who reported the flaw as of February 9.

Malware 121