Happy Patch Tuesday from **Fortinet**:<li><a ...

Not Simon 🐐 /

npub14g0…znd6

2024-06-11 15:02:03

Happy Patch Tuesday from **Fortinet**:<li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-24-128"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-24-128</a> CVE-2024-31495 (4.3 medium) Blind SQL Injection</li><li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-24-036"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-24-036</a> CVE-2024-26010 (7.5 high) Buffer overflow in fgfmd</li><li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-23-471"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-23-471</a> CVE-2024-23111 (6.8 medium) FortiOS/FortiProxy - XSS in reboot page</li><li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-23-495"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-23-495</a> CVE-2023-23775 (6.5 medium) FortiSOAR is vulnerable to sql injection in Event Auth API via uuid parameter</li><li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-23-460"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-23-460</a> CVE-2024-23110 (7.8 high) Multiple buffer overflows in diag npu command</li><li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-23-356"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-23-356</a> CVE-2023-46720 (6.7 medium) Stack buffer overflow on bluetooth write feature</li><li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-24-170"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-24-170</a> TunnelVision - CVE-2024-3661 (5.0 medium) (See <strong>Leviathan Security</strong> analysis: <a href="https://www.leviathansecurity.com/blog/tunnelvision"; target="_blank" rel="nofollow noopener noreferrer">TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak</a> for more information on <a href="https://infosec.exchange/tags/TunnelVision"; class="mention hashtag" rel="tag">#<span>TunnelVision</span></a>, VPN bypass technique)</li><li><a href="https://fortiguard.fortinet.com/psirt/FG-IR-23-423"; target="_blank" rel="nofollow noopener noreferrer">FG-IR-23-423</a> CVE-2024-21754 (1.8 low) Weak key derivation for backup file</li>

No mention of exploitation. Let the Patch Tuesday madness begin!

#PatchTuesday #vulnerability #Fortinet #CVE

Author Public Key

npub14g0mj0fmn0sepfuhp2wupyk7d8xyz7rezpmrx2gfsav9vxlwxypq4xznd6

Seen on

wss://relay.nostr.band

Show more details

Published at

2024-06-11 15:02:03

Kind type

1 Short Text Note

Event JSON

{ "id": "d2c677499752d2ea2b4d8202de8c88d02fe305d48b8bbca1d9cdab3325b7e344", "pubkey": "aa1fb93d3b9be190a7970a9dc092de69cc41787910763329098758561bee3102", "created_at": 1718118123, "kind": 1, "tags": [ [ "t", "patchtuesday" ], [ "t", "fortinet" ], [ "t", "vulnerability" ], [ "t", "tunnelvision" ], [ "proxy", "https://infosec.exchange/@screaminggoat/112598589371564034", "web" ], [ "t", "cve" ], [ "proxy", "https://infosec.exchange/users/screaminggoat/statuses/112598589371564034", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/screaminggoat/statuses/112598589371564034", "pink.momostr" ] ], "content": "Happy Patch Tuesday from **Fortinet**:\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-24-128\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-24-128\u003c/a\u003e CVE-2024-31495 (4.3 medium) Blind SQL Injection\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-24-036\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-24-036\u003c/a\u003e CVE-2024-26010 (7.5 high) Buffer overflow in fgfmd\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-23-471\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-23-471\u003c/a\u003e CVE-2024-23111 (6.8 medium) FortiOS/FortiProxy - XSS in reboot page\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-23-495\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-23-495\u003c/a\u003e CVE-2023-23775 (6.5 medium) FortiSOAR is vulnerable to sql injection in Event Auth API via uuid parameter\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-23-460\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-23-460\u003c/a\u003e CVE-2024-23110 (7.8 high) Multiple buffer overflows in diag npu command\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-23-356\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-23-356\u003c/a\u003e CVE-2023-46720 (6.7 medium) Stack buffer overflow on bluetooth write feature\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-24-170\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-24-170\u003c/a\u003e TunnelVision - CVE-2024-3661 (5.0 medium) (See \u003cstrong\u003eLeviathan Security\u003c/strong\u003e analysis: \u003ca href=\"https://www.leviathansecurity.com/blog/tunnelvision\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eTunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak\u003c/a\u003e for more information on \u003ca href=\"https://infosec.exchange/tags/TunnelVision\" class=\"mention hashtag\" rel=\"tag\"\u003e#\u003cspan\u003eTunnelVision\u003c/span\u003e\u003c/a\u003e, VPN bypass technique)\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://fortiguard.fortinet.com/psirt/FG-IR-23-423\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"\u003eFG-IR-23-423\u003c/a\u003e CVE-2024-21754 (1.8 low) Weak key derivation for backup file\u003c/li\u003e\n\nNo mention of exploitation. Let the Patch Tuesday madness begin! \n\n#PatchTuesday #vulnerability #Fortinet #CVE", "sig": "e16f3f839d9d8c05b05725ab80dc1253416b9b6593b72ffe2a307fa03d17d76be9a72a125a1d0285775b3023d6bf80520e755ba39c205cf2eca8653f2e743b34" }