Monday , December 23 2024
fortinet

Fortinet Patches Multiple Vulnerabilities including FortiOS & Other

Fortinet has fixed vulnerabilities in its products FortiOS, FortiProxy, FortiPAM, FortiSwitchManager, FortiManager, and FortiAnalyzer. The vulnerabilities could be used to gain unauthorized access and increase privileges, posing a major threat to affected systems.

Vulnerability Details:

Critical PHP Zero-Day Vulnerability found in Craft CMS To Gain RCE

A major security flaw in Craft CMS, a popular PHP content management system, has been found, enabling unauthenticated remote code...
Read More
Critical PHP Zero-Day Vulnerability found in Craft CMS To Gain RCE

For US$2.6bn, Mastercard acquires threat intelligence firm Recorded Future

Mastercard has completed its acquisition of Recorded Future, an AI-based threat intelligence provider. Mastercard has acquired the company for $2.65...
Read More
For US$2.6bn, Mastercard acquires threat intelligence firm Recorded Future

Eight New ICS Advisories released by CISA

CISA has released eight advisories on vulnerabilities in Industrial Control Systems (ICS). These vulnerabilities affect essential software and hardware in...
Read More
Eight New ICS Advisories released by CISA

Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI

Bank Rakyat Indonesia (BRI), the largest state bank by assets, has assured customers that their data and funds are secure...
Read More
Authority Denies  Hacker claim ransomware attack on Indonesia’s state bank BRI

London-based company “Builder.ai” reportedly exposed 1.2 TB data

Cybersecurity researcher Jeremiah Fowler reported to Website Planet that he found a non-password-protected 1.2 TB dataset containing over 3 million...
Read More
London-based company “Builder.ai” reportedly exposed 1.2 TB data

(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall

Sophos has fixed three separate security vulnerabilities in Sophos Firewall.  The vulnerabilities CVE-2024-12727, CVE-2024-12728, and CVE-2024-12729 present major risks, such...
Read More
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)  Sophos resolved 3 critical vulnerabilities in Firewall

“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA

A time-demanding workshop on "Cybersecurity Awareness and Needs Analysis" was held on Thursday (December 19) at Bangladesh Bank Training Academy...
Read More
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA

CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability

Kaspersky's Global Emergency Response Team (GERT) found that attackers are exploiting a patched SQL injection vulnerability (CVE-2023-48788) in Fortinet FortiClient...
Read More
CVE-2023-48788  Kaspersky reveals active exploitation of Fortinet Vulnerability

U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports

The US government is considering banning a well-known brand of Chinese-made home internet routers TP-Link due to concerns that they...
Read More
U.S. Weighs Ban on Chinese-Made Router TP-Link:  WSJ reports

Daily Security Update Dated: 18.12.2024

Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Update Dated: 18.12.2024

CVE-2022-45862
The graphical user interface (GUI) of FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager was identified as having an insufficient session expiration vulnerability (CWE-613).

Attackers could exploit this flaw to reuse web sessions even if a user has logged out, as long as they have the required credentials.

The vulnerability has a CVSSv3 score of 3.5, indicating a medium severity level due to improper access control. Affected products and their solutions include:

FortiOS:
Versions 7.2.0 to 7.2.5 need to be upgraded to 7.2.6 or a higher version. Both versions 7.0 and 6.4 are affected and require a migration to a fixed release.

FortiPAM:
All versions from 1.0 to 1.3 are affected and require migration to a fixed release.

FortiProxy:
All versions of 7.2 and 7.0 are affected and need migration to a fixed release.

FortiSwitchManager:
Versions 7.2.0 to 7.2.1 are impacted and need to be updated to 7.2.2 or higher.

CVE-2024-21757

A vulnerability (CWE-620) was found in FortiManager and FortiAnalyzer that could allow a read-write user to change admin passwords through device configuration backup, potentially leading to privilege escalation.

The vulnerability carries a CVSSv3 score of 5.5. Affected versions and solutions are:

FortiAnalyzer:
Version 7.4.0 through 7.4.1 should be upgraded to 7.4.2 or later, and versions 7.2.0 through 7.2.4 should be upgraded to 7.2.5 or later.

FortiManager:
“For versions 7.4.0 through 7.4.1, upgrade to 7.4.2 or higher. For versions 7.2.0 through 7.2.4, upgrade to 7.2.5 or higher.”

CVE-2024-36505:
There’s a security issue in FortiOS (CWE-284) that allows a person with write access to get around the file integrity checking system. Its CVSSv3 score is 4.7. The affected versions that need updates are:

FortiOS:
Versions 7.4.0 – 7.4.3 should be updated to 7.4.4 or higher, versions 7.2.5 – 7.2.7 should be updated to 7.2.8 or higher, and versions 7.0.12 – 7.0.14 should be updated to 7.0.15 or higher.

Fortinet has not reported any attacks using these vulnerabilities. Fortinet recommends applying updates to protect against vulnerabilities and maintain system security. This is important to prevent exploitation by cyber threats.

Check Also

sonicwall

Over 25K SonicWall VPN Firewalls exposed to critical flaws

More than 25,000 SonicWall SSL VPN devices are vulnerable to critical flaws, with 20,000 running …

Leave a Reply

Your email address will not be published. Required fields are marked *