Fortinet addressed a critical severity vulnerability impacting the FortiClient Enterprise Management Server. Tracked as CVE-2023-48788, the vulnerability may allow an attacker to achieve code execution on affected systems. The vulnerability has been given a CVSS score of 9.3.
Tag: SQL injection
Ivanti Patches Critical SQL Injection Vulnerability in Endpoint Manager (CVE-2023-39336)
A critical severity SQL injection vulnerability has been discovered in the Ivanti Endpoint Manager. Tracked as CVE-2023-39336, the vulnerability has been given a critical severity rating with a CVSS score of 9.6. Successful exploitation of the vulnerability may allow an attacker to execute arbitrary SQL queries and retrieve output without needing authentication.
Cacti Unauthenticated SQL Injection Vulnerability (CVE-2023-39361)
Cacti, a widely used operational monitoring tool, is vulnerable to a SQL injection flaw that may allow an attacker to perform code execution on successful exploitation. CVE-2023-39361 has a critical severity rating with a CVSS score of 9.8. The vulnerability may allow an unauthenticated user to execute arbitrary code on a Cacti server if a … Continue reading “Cacti Unauthenticated SQL Injection Vulnerability (CVE-2023-39361)”
MOVEit Transfer Privilege Escalation and Potential Unauthorized Access Vulnerability (CVE-2023-35708)
Progress has discovered a privilege escalation vulnerability in the MOVEit Transfer web application (CVE-2023-35708). On successful exploitation, the vulnerability may allow an attacker to gain unauthorized access to the MOVEit Transfer database. There is no evidence to suggest that the vulnerability is being exploited in the wild. MOVEit Transfer is a managed file transfer (MFT) … Continue reading “MOVEit Transfer Privilege Escalation and Potential Unauthorized Access Vulnerability (CVE-2023-35708)”
Critical SQL Injection Vulnerability in MOVEit Managed File Transfer Web Application (CVE-2023-35036)
Multiple MOVEit Managed File Transfer Web Application versions face SQL Injection vulnerability (CVE-2023-35036). Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. MOVEit has accredited Cybersecurity firm Huntress for discovering the vulnerability. MOVEit Transfer is a managed file transfer (MFT) solution available in an on-premises … Continue reading “Critical SQL Injection Vulnerability in MOVEit Managed File Transfer Web Application (CVE-2023-35036)”
Artica Proxy Multiple Security Vulnerabilities
Artica Proxy is a system that provides a Web Ajax console in order to manage a full Proxy server with latest Squid technology. Security Researcher Amar Kaldate, and Pratiksha Dhone from Qualys have reported multiple vulnerabilities in Artica Proxy Project. Vulnerability Details CVE-2020-13158 – Directory Traversal Artica Proxy Community Edition allows Directory Traversal via the … Continue reading “Artica Proxy Multiple Security Vulnerabilities”
Sophos XG-firewall SQL injection bug (CVE-2020-12271)
Summary: Amidst the global lockdown 2020, while the April month is about to end, a major security giant, Sophos was affected with SQL injection bug exploited in the wild, impacting its XG Firewall product. Sophos said it first learned of the zero-day on late Wednesday, April 22, after it received a report from one of … Continue reading “Sophos XG-firewall SQL injection bug (CVE-2020-12271)”
Zoho ManageEngine OpManager 12.0 Multiple Vulnerabilities
Abstract: While doing our daily research for ThreatPROTECT, I came across ManageEngine, Zoho Corporation’s OpManager product. It is a network monitoring software that helps administrators discover, map, monitor and manage complete IT infrastructure thereby providing all the visibility and control that you need over your network. So we decided to use it for our internal … Continue reading “Zoho ManageEngine OpManager 12.0 Multiple Vulnerabilities”