Feb 15, 2024
2 new incidents, 1 with updates.
Started
- ClosedCriticalPatched
Fortinet Multiple Products Format String
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-09.
Fortinet Multiple ProductsClosed Oct 9, 2024
- ClosedHighPatched
Cisco ASA and FTD Information Disclosure
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Added to the CISA KEV catalog on 2024-02-15. CISA lists known use in ransomware campaigns. CVE-2020-3259 was assigned before 2024; the KEV listing came in 2024.
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Closed Feb 15, 2024
Updated
- ClosedCriticalPatched
Microsoft Exchange Server Privilege Escalation
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. Added to the CISA KEV catalog on 2024-02-15.
Microsoft Exchange ServerClosed Feb 15, 2024
