CISA issues alert on actively exploited flaws in Fortinet, Ivanti and Nice products

ReportMarch 26, 2024Editorial DepartmentCyber ​​attacks/vulnerabilities

CISA alert

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday listed three security vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The new vulnerabilities are as follows:

  • CVE-2023-48788 (CVSS Rating: 9.3) – Fortinet FortiClient EMS SQL Injection Vulnerability
  • CVE-2021-44529 (CVSS score: 9.8) – Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) code injection vulnerability
  • CVE-2019-7256 (CVSS score: 10.0) – Nice Linear eMerge E3 series operating system command injection vulnerability

The flaw affecting Fortinet FortiClient EMS came to light earlier this month, and the company described it as a flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted request.

Internet security

Fortinet has since revised its advisory to confirm that it has been exploited in the wild, but no other details about the nature of the attack are currently available.

On the other hand, CVE-2021-44529 involves a code injection vulnerability in the Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA), which allows unauthenticated users to execute malicious code with limited permissions.

Recently published research by security researcher Ron Bowes suggests that the flaw may be a deliberately introduced backdoor in an open source project called csrf-magic, which has existed since at least 2014 and has now been discontinued.

CVE-2019-7256 allows attackers to execute remote code on Nice Linear eMerge E3 series access controllers and was exploited by threat actors as early as February 2020.

Nice (formerly Nortek) fixed that flaw and 11 other bugs earlier this month. That said, these vulnerabilities were originally disclosed by security researcher Gjoko Krstic in May 2019.

Given that these three vulnerabilities are actively exploited, federal agencies have until April 15, 2024 to apply vendor-provided mitigations.

The development comes as CISA and the FBI issued a joint alert urging software manufacturers to take steps to mitigate SQL injection flaws.

Internet security

The advisory specifically highlights how the Cl0p ransomware gang, also known as Lace Tempest, exploited a critical SQL injection vulnerability, CVE-2023-34362, in Progress Software’s MOVEit Transfer to compromise thousands of organizations.

“Despite the fact that SQLi vulnerabilities have been widely known and documented over the past two decades and effective mitigations have been implemented, software manufacturers continue to develop products with this flaw, leaving many customers exposed,” the agencies said. risk.”

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/cisa-issues-alert-on-actively-exploited-flaws-in-fortinet-ivanti-and-nice-products/
via https://techempiresolutions.com/

from Tech Empire Solutions https://techempiresolutions.blogspot.com/2024/03/cisa-issues-alert-on-actively-exploited.html
via https://techempiresolutions.com/

Comments

Post a Comment

Popular posts from this blog

Perfecta grill uses AI to help cook steaks in 90 seconds

Image
CES is increasingly becoming a barbecue show, and companies are constantly looking for ways to bring more technology to your deck or patio. One company adding artificial intelligence technology to its spice racks is Seergerills, a British startup made up of engineers and product developers. Its flagship model, the Perfecta, can cook a one-inch-thick rib-eye steak in 90 seconds. Overall, the company says the grill looks more like a see-through countertop oven and cooks food about 10 times faster than traditional cooking methods. Inside, dual vertical infrared burners cook both sides simultaneously, which not only speeds up the process but also eliminates the need for flipping. Seergerills says the burner has a maximum temperature of 1,652 degrees Fahrenheit, and the unit even ensures crisp edges thanks to 360-degree heating. The built-in artificial intelligence chef calculates the appropriate cooking time and temperature based on the food, taking into account the desired degree of done
Read more

John Wick heads to Vegas to visit interactive attractions

Image
image: Lionsgate If you’ve ever wanted to fully immerse yourself in John Wick , Lionsgate has got you covered. Later this year, action series is becoming “immersive and interactive” tourist attractions In Las Vegas. Grace Byers on horror and comedy in ‘The Dark’ According to the press release, John Wick Experience Produced in collaboration with series director Chad Stahelski and his production company 87Eleven. The 12,000-square-foot exhibit at the city’s AREA15 campus lets visitors “experience high-stakes adventures and visit themed bars and retail stores open to the public.” Guests will be given specific tasks involving characters and images from the film. They’ll also rub shoulders with Continental employees, crime bosses, and other assassins who (presumably) don’t come into contact with Wick’s bad side at any point in the movie, all in an effort to gain access to private Continental areas and learn about the interesting secret. Jenefer Brown, exec
Read more

Ford prepares for next war, Waymo recalls its self-driving car software, another self-driving startup lays off employees

Image
TechCrunch Mobility is a weekly newsletter dedicated to all things transportation. Sign up here – just click TechCrunch Mobility – and get the newsletter in your inbox every weekend. Subscription is free. welcome back TechCrunch Mobile — A central hub for news and insights about the future of transportation.This week’s news includes BMW Security breach exposes sensitive information, federal agencies fight back against Tesla super bowl ad and a new federal investigation Fisker . But first, I want to talk about my recent visit to the law, where I met some people Ford Executives understand their priorities for 2024 and beyond. It can be said with certainty Chinese electric vehicle manufacturer and Tesla is the most important; in the view of Ford executives, low-cost electric vehicles and cutting-edge software are the best ways to stop these threats. The company’s recently revealed Skunk Works project for electric vehicles is tasked with this task. Ford Chief Financial Officer J
Read more