Fortinet FortiManager and FortiAnalyzer Security Vulnerabilities

Fortinet FortiManager and Fortinet FortiAnalyzer are both products from Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains...

PT-2023-5994

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions 7.4.0 and before 7.2.3 Fortinet FortiAnalyzer versions 7.4.0 and before 7.2.3 Description The issue is related to the implementation of client-side security features. It may allow a remote attacker with low...

Unprivileged user can access web console and run some unauthorized commands

...

CVE-2023-42787: Client-Side Enforcement of Server-Side Security

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...

PT-2023-6051 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the...

GitHub: Invite tokens have Insufficient entropy in GHES Management Console

An insufficient entropy vulnerability in GitHub Enterprise Server invitation tokens allowed brute force attacks against pending user invitations to the management console. This affected all versions since 3.8 and was fixed in 3.8.12, 3.9.7, 3.10.4, and 3.11.1...

RLSA-2023:4517 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use-after-free in l2capconnect and l2capleconnectreq in net/bluetooth/l2capcore.c CVE-2022-42896 kernel: tcindex: use-after-free vulnerability in traffic control index filter allows...

CVE-2023-26239

An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user...

CVE-2023-26239

An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user...

Default credentials

An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user...

PT-2023-20556 · Watchguard · Watchguard Epdr

Name of the Vulnerable Software and Affected Versions: WatchGuard EPDR version 8.0.21.0002 Description: An issue was discovered due to a weak implementation of a password check, making it possible to obtain credentials to access the management console as a non-privileged user. Recommendations: Fo...

CVE-2023-26239

Affected software: WatchGuard EPDR 8.0.21.0002. Vulnerability: weak implementation of a password check that can allow a non-privileged user to obtain credentials to access the management console. This is described across multiple sources in the connected documents as a credential-access weakness ...

CVE-2023-26239

An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user...

WatchGuard EPDR Security Vulnerability

WatchGuard EPDR is an application from WatchGuard USA, Inc. prevents, detects and responds to any type of known and unknown malware as well as fileless and malware-free attacks. A security vulnerability exists in WatchGuard EPDR version 8.0.21.0002, which stems from a weak implementation of...

CVE-2023-26239: Improper Check for Dropped Privileges

An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user...

CVE-2023-26239

An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user...

Rogue npm Package Deploys Open-Source Rootkit in New Supply Chain Attack

A new deceptive package hidden within the npm package registry has been uncovered deploying an open-source rootkit called r77, marking the first time a rogue package has delivered rootkit functionality. The package in question is node-hide-console-windows, which mimics the legitimate npm package...

WEM - All Organizational Units under Active Directory Objects are not listed

In some customer environment all OUs Organizational Unit may not be listed in WEM Administration Console - Active Directory Objects - Machines - Add OU. However, administrator can manually add computer objects without any issue...

Nozomi Guardian SQL Injection

The vulnerability of the Nozomi Guardian detection and tracking tool for network activities, as well as the Nozomi Central Management Console CMC, relates to the lack of protective measures taken against SQL query structures during parameter sorting. Exploiting this vulnerability could allow an...

SAML DoS

The vulnerability of the SAML Security Assertion Markup Language technology used in the Nozomi Guardian network detection and monitoring tool, as well as the Nozomi Central Management Console CMC, relates to insufficient validation of input data during the loading of configuration files. Exploiti...