CVE-2023-27997

A heap-based buffer overflow vulnerability CWE-122 in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all...

CVE-2023-27997

CVE-2023-27997 is a heap-based buffer overflow in Fortinet FortiOS SSL‑VPN (and FortiProxy) that allows remote code execution via specially crafted requests. Affected families include FortiOS: 7.2.x <=7.2.4, 7.0.x <=7.0.11, 6.4.x <=6.4.12, 6.0.x <=6.0.16; FortiProxy: 7.2.x <=7.2.3,...

CVE-2023-27997

A heap-based buffer overflow vulnerability CWE-122 in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all...

Datalogics Library Third-Party

1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: Datalogics Equipment: Library APDFL v18.0.4PlusP1e Vulnerability: Stack-based buffer overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to crash the device. 3. TECHNICAL...

Critical FortiOS and FortiProxy Vulnerability Likely Exploited - Patch Now!

Fortinet on Monday disclosed that a newly patched critical flaw impacting FortiOS and FortiProxy may have been "exploited in a limited number of cases" in attacks targeting government, manufacturing, and critical infrastructure sectors. The vulnerability, dubbed XORtigate and tracked as...

CVE-2023-27997

A heap-based buffer overflow vulnerability CWE-122 in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all...

The vulnerability of the SSL-VPN portal for FortiOS operating systems and the FortiProxy proxy server, which allows attackers to execute arbitrary code.

The vulnerability of the SSL-VPN portal for FortiOS operating systems and the FortiProxy proxy server used for protecting against internet attacks is related to the possibility of buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending...

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests...

Critical RCE Flaw Discovered in Fortinet FortiGate Firewalls - Patch Now!

Fortinet has released patches to address a critical security flaw in its FortiGate firewalls that could be abused by a threat actor to achieve remote code execution. The vulnerability, tracked as CVE-2023-27997 , is "reachable pre-authentication, on every SSL VPN appliance," Lexfo Security...

Critical RCE Flaw Discovered in Fortinet FortiGate Firewalls - Patch Now!

Fortinet has released patches to address a critical security flaw in its FortiGate firewalls that could be abused by a threat actor to achieve remote code execution. The vulnerability, tracked as CVE-2023-27997, is "reachable pre-authentication, on every SSL VPN appliance," Lexfo Security...

Public and free WiFi: Can I safely use it?

We've got into the habit of expecting internet access wherever we go. But data costs can be expensive, and out of your own home often the only WiFi available is public, passwordless and free. In security, we've been trained to carefully contemplate anything that's free, because, well, often when...

Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution Exploit

This Metasploit module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange IKE packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are as follows: ATP Firmware version 4.60 to 5.35 inclusive, USG FLEX...

PT-2023-3230 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.0.0 through 6.0.16 FortiOS versions 6.2.0 through 6.2.14 FortiOS versions 6.4.0 through 6.4.12 FortiOS versions 7.0.0 through 7.0.11 FortiOS versions 7.2.0 through 7.2.4 FortiProxy versions 1.0.0 through 1.0.7 FortiProxy...

Protect

A heap-based buffer overflow vulnerability CWE-122 in FortiOS and FortiProxy SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests...

Protect

A NULL pointer dereference vulnerability CWE-476 in FortiOS may allow an authenticated attacker to crash the SSL-VPN daemon via specially crafted HTTP requests to the /proxy endpoint...

Protect

A NULL pointer dereference vulnerability CWE-476 in FortiOS may allow a remote unauthenticated attacker to crash the SSL-VPN daemon via specially crafted HTTP requests...

Vulnerabilities fixed in Fortinet FortiGate

Fortinet has released updates to its FortiGate software. Security researchers indicate that in these updates a serious vulnerability has been fixed in the VPN-SSL. A malicious party could exploit the vulnerability to execute arbitrary code without prior authentication to execute arbitrary code on...

PT-2023-3075

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.2.5 FortiOS versions prior to 7.0.12 FortiOS versions prior to 6.4.13 FortiOS versions prior to 6.0.17 FortiProxy versions prior to 7.2.4 FortiProxy versions prior to 7.0.10 FortiProxy versions prior to 2.0.13...

Update your Cisco System Secure Client now to fix this AnyConnect bug

Cisco Secure Client is the fresh recipient of a fix to address a high-severity vulnerability related to improper permissions. The flaw allows attackers to potentially escalate privileges to the SYSTEM account. From the vulnerability advisory: A vulnerability in the client update feature of Cisco...

Prompt error "Cannot start desktop" when launching desktop through SSLVPN

End-users fist build SSLVPN connection to Citrix Gateway: Access Storefront directly tolaunch their desktops. Below error prompt:"Cannot start desktop ". ICA file cannot be downloaded...