#cve2022 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #cve2022, aggregated by home.social.
-
"🚨 #FortinetFlaw Alert! RCE Vulnerability in SSL VPN - Act Now! 🚨"
Fortinet's SSL VPN is in the spotlight due to a newly discovered RCE vulnerability, potentially exploited in recent attacks due to the existence of an exploit being publicly available. Identified as CVE-2022-40684 (FG-IR-24-015) (Critical/9.8 rating), this flaw allows unauthenticated attackers to execute arbitrary code. Upgrading to version 6.2.16, 6.4.15, 7.0.14, 7.2.7 or 7.4.3 eliminates this vulnerability. Security researchers urge immediate patching as exploits are likely circulating. 🛡️💻🔐
#CyberSecurity #RCE #Fortinet #Vulnerability #PatchNow #InfoSec #SSLVPN #Exploit
Source: BleepingComputer, Tenable
Tags: #CVE2022-40684 #FORTIOS #SecurityUpdate #Mitigation #InfoSecCommunity #CyberThreats #FGIR24015
-
"🚨 #FortinetFlaw Alert! RCE Vulnerability in SSL VPN - Act Now! 🚨"
Fortinet's SSL VPN is in the spotlight due to a newly discovered RCE vulnerability, potentially exploited in recent attacks due to the existence of an exploit being publicly available. Identified as CVE-2022-40684 (FG-IR-24-015) (Critical/9.8 rating), this flaw allows unauthenticated attackers to execute arbitrary code. Upgrading to version 6.2.16, 6.4.15, 7.0.14, 7.2.7 or 7.4.3 eliminates this vulnerability. Security researchers urge immediate patching as exploits are likely circulating. 🛡️💻🔐
#CyberSecurity #RCE #Fortinet #Vulnerability #PatchNow #InfoSec #SSLVPN #Exploit
Source: BleepingComputer, Tenable
Tags: #CVE2022-40684 #FORTIOS #SecurityUpdate #Mitigation #InfoSecCommunity #CyberThreats #FGIR24015
-
"🚨 NGINX Ingress Vulnerabilities Exposed! 🚨"
Three new vulnerabilities have been identified in the NGINX ingress controller for Kubernetes. These vulnerabilities, tagged as CVE-2023-5043, CVE-2023-5044, and CVE-2022-4886, could potentially allow attackers to steal secret credentials from the cluster. 🕵️♂️🔓
CVE-2023-5043 & CVE-2023-5044: These vulnerabilities can be exploited by attackers who can control the Ingress object's configuration. By using the annotation fields “configuration-snippet” or “permanent-redirect”, attackers can inject arbitrary code into the ingress controller process, gaining access to the service account token of the ingress controller. This token has a ClusterRole, enabling reading of all Kubernetes secrets in the cluster. 😱
CVE-2022-4886: This vulnerability lies in the way the “path” field is used in the Ingress routing definitions. A flaw in the validation of the inner path can lead to exposure of the service account token, which is used for authentication against the API server. 🚫
Mitigation steps include updating NGINX to version 1.19 and enabling the “--enable-annotation-validation” command line configuration. 🛡️
These vulnerabilities underscore the importance of securing ingress controllers, given their high privilege scope and potential exposure to external traffic.
Source: ARMO Blog by Ben Hirschberg, CTO & Co-founder.
Tags: #NGINX #Kubernetes #Vulnerability #CyberSecurity #IngressController #CVE2023 #CVE2022 🌐🔐🔍
-
"🚨 NGINX Ingress Vulnerabilities Exposed! 🚨"
Three new vulnerabilities have been identified in the NGINX ingress controller for Kubernetes. These vulnerabilities, tagged as CVE-2023-5043, CVE-2023-5044, and CVE-2022-4886, could potentially allow attackers to steal secret credentials from the cluster. 🕵️♂️🔓
CVE-2023-5043 & CVE-2023-5044: These vulnerabilities can be exploited by attackers who can control the Ingress object's configuration. By using the annotation fields “configuration-snippet” or “permanent-redirect”, attackers can inject arbitrary code into the ingress controller process, gaining access to the service account token of the ingress controller. This token has a ClusterRole, enabling reading of all Kubernetes secrets in the cluster. 😱
CVE-2022-4886: This vulnerability lies in the way the “path” field is used in the Ingress routing definitions. A flaw in the validation of the inner path can lead to exposure of the service account token, which is used for authentication against the API server. 🚫
Mitigation steps include updating NGINX to version 1.19 and enabling the “--enable-annotation-validation” command line configuration. 🛡️
These vulnerabilities underscore the importance of securing ingress controllers, given their high privilege scope and potential exposure to external traffic.
Source: ARMO Blog by Ben Hirschberg, CTO & Co-founder.
Tags: #NGINX #Kubernetes #Vulnerability #CyberSecurity #IngressController #CVE2023 #CVE2022 🌐🔐🔍
-
Using #SQLServer and the #NetFramework then you should install the November Update! #cve2022-41064