Pierluigi Paganini
February 05, 2021
Security vendor Fortinet has addressed four vulnerabilities in FortiWeb web application firewalls, including a Remote Code Execution flaw. Fortinet has addressed four vulnerabilities in FortiWeb web application firewalls that were reported by Positive Technologies expert Andrey Medov. The first vulnerability, tracked as CVE-2020-29015, is a blind SQL injection that resides in the FortiWeb user interface. […]
Pierluigi Paganini
January 28, 2020
The vendor Fortinet has finally released security patches to remove the hardcoded SSH keys in Fortinet SIEM appliances. Fortinet has finally released security updates to remove the hardcoded SSH keys in Fortinet SIEM appliances. Recently Andrew Klaus, a security specialist from Cybera, discovered a hardcoded SSH public key in Fortinetâs Security Information and Event Management FortiSIEM that […]
Pierluigi Paganini
January 21, 2020
Expert found a hardcoded SSH public key in Fortinet âs Security Information and Event Management FortiSIEM that can allow access to the FortiSIEM Supervisor. Andrew Klaus, a security specialist from Cybera, discovered a hardcoded SSH public key in Fortinetâs Security Information and Event Management FortiSIEM that can be used by attackers to the FortiSIEM Supervisor. […]
Pierluigi Paganini
November 26, 2019
Researchers at SEC Consult Vulnerability Lab discovered multiple issues in several security products from Fortinet, including hardcoded key and encryption for communications. Security researchers from SEC Consult Vulnerability Lab discovered that multiple Fortinet products use a weak encryption cipher (âXORâ with a static key) and cryptographic keys to communicate with the FortiGuard Web Filter, AntiSpam […]
Pierluigi Paganini
August 23, 2019
Hackers are exploiting recently disclosed flaws in enterprise virtual private network (VPN) products from Fortinet and Pulse Secure. The popular cybersecurity expert Kevin Beaumont has observed threat actors attempting to exploit the CVE-2018-13379 in the FortiOS SSL VPN web portal and CVE-2019-11510 flaw in Pulse Connect Secure. The CVE-2018-13379 is a path traversal vulnerability in the […]
Pierluigi Paganini
December 14, 2017
FortiClient for Linux, Mac OSX and Windows stores encrypted VPN authentication credentials in improperly secured locations. Fortinet provided security updates for its next-generation endpoint protection FortiClient product that address a serious information disclosure vulnerability. The flaw, tracked as CVE-2017-14184, could be exploited by an attacker to obtain VPN authentication credentials. FortiClient is a powerful product that includes […]
Pierluigi Paganini
August 18, 2016
Customers of Cisco and Fortinet security firms need to patch their products to fix the flaws exploited by the Equation Group exploits and hacking tools. While security experts are analyzing the hacking tools leaked in the data dump by the Shadow Brokers, security firms are working to fix the vulnerabilities exploited by the Equation Group toolsets. Both […]
Pierluigi Paganini
January 23, 2016
A review of all the products allowed Fortinet to discover the same SSH backdoor on some versions of its solutions. Recently security experts reported the presence of a SSHÂ backdoor in Fortinet firewalls, news of the day is that the company has found the same backdoor also in several new products, many of them running current […]
Pierluigi Paganini
November 06, 2014
Security experts at Fortinet detected a new variant of Backoff malicious code dubbed ROM, which is an improved version of the popular POS malware. A new strain of the Backoff point of sale malware has been detected in the wild by security experts at Fortinet, the new variant dubbed ROM (W32/Backoff.B!tr.spy) appears more fine-tuned. Like Backoff, ROM […]
Pierluigi Paganini
July 03, 2013
Information provided by the results of principal researches on the cybercrime reveals resources,motivations and methods and cost illegal operations. Fortinet has published early 2013 the Fortinet’s 2013 cybercrime report, an interesting study on cybercriminal ecosystem, identifying the operations, the motivations, the methods, the resource used and countermeasure adoptable to mitigate the cyber threats As demonstrated […]
