Fortinet, Ivanti, Nvidia Release Security Updates

Fortinet, Ivanti, and Nvidia on Tuesday announced security updates addressing more than a dozen high- and medium-severity vulnerabilities across their product lines. Ivanti resolved two high-severity insufficient filename validation issues in Endpoint Manager that could be exploited remotely, without authentication, to execute arbitrary code, with exploitation requiring user interaction.

The company also released patches for five high- and six medium-severity vulnerabilities in Connect Secure, Policy Secure, ZTA Gateways, and Neurons for Secure Access, including a missing authorisation issue that could lead to HTML5 connection hijacking, a CSRF bug enabling unauthenticated actions, and missing authorisation flaws that could allow configuration of authentication

settings; patches span EPM versions 2024 SU3 SR1 and 2022 SU8 SR2, Connect Secure 22.7R2.9 and 22.8R2, Policy Secure 22.7R1.5, ZTA Gateways 22.8R2.3-723, and Neurons for Secure Access 22.8R1.4. “We have no evidence of any of these vulnerabilities being exploited in the wild,” according to Ivanti.

Fortinet released fixes for a medium-severity OS command injection in FortiDDoS and a medium-severity path traversal in FortiWeb, while Nvidia rolled out fixes in the NVDebug tool (version 1.7.0) for one high- and two medium-severity defects that could allow privileged access, file writes, or code execution.