Overview Recently, NSFOCUS CERT found that Fortinet officially issued a security notice to fix a Fortinet FortiOS and FortiProxy remote code execution vulnerability (CVE-2023-25610). Due to the heap buffer underflow flaw in the management interface of FortiOS and FortiProxy, an unauthenticated remote attacker can execute arbitrary code on the target...
Category: Emergency Response
Multiple Apache HTTP Server Security Vulnerabilities
Overview Recently, NSFOCUS CERT found that Apache has issued an official security notice to fix multiple Apache HTTP Server vulnerabilities. Affected users should take protective measures as soon as possible. Apache HTTP Server Request Smuggling Vulnerability (CVE-2023-25690): When mod_ When proxy is enabled with some form of RewriteRule or ProxyPassMatch,...
Microsoft Word Remote Code Execution Vulnerability (CVE-2023-21716)
Overview Recently, NSFOCUS CERT found the PoC that disclosed Microsoft Word remote execution code vulnerability (CVE-2023-21716) on the Internet. Because the RTF parser in Microsoft Word will trigger a heap corruption vulnerability when processing a font table (* fonttbl *) that contains too many fonts (* f # # #...
GitLab Cross-Site Scripting (XSS) Vulnerability (CVE-2023-0050)
Overview Recently, NSFOCUS CERT found that GitLab has issued an official security notice to fix a cross-site scripting vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) (CVE-2023-0050). A remote attacker with low privileges can cause the client to store XSS through a specially crafted Kroki diagram, and finally...
Node.js Authentication Bypass Vulnerability (CVE-2023-23918) Notice
Overview Recently, NSFOCUS CERT detected that Node.js officially fixed an authentication vulnerability (CVE-2023-23918). Due to the flaw of improper permission control in Node.js, a remote attacker can use the process.mainModule.require() function to bypass permissions and access unauthorized modules. The official said that this vulnerability only affects users who have enabled...
Multiple Security Vulnerabilities in Google Chrome
Overview Recently, NSFOCUS CERT detected that Google Chrome officially released a security bulletin, which fixed multiple security vulnerabilities. The key vulnerabilities are as follows: Google Chrome use-after-free vulnerability (CVE-2023-0927): Due to a use-after-free flaw in the Web Payments API in Google Chrome, a remote attacker capable of compromising the renderer...
