OGO Security - Notice history

• New drives detecting PAN-OS CVE-2024-9474, WP Really Simple Security CVE-2024-10924

• SQLi detections enhancements

• Log Filtering: Added the ability to filter logs by attack type.

• New drive that instantly blocks requests with obvious attack patterns, configurable in expert mode.

• New experimental Slowloris drive.

• SQLi, directory traversal, and Linux & Windows LFI are now more broadly detected.

• New Booster drive : Scripting or empty user-agent. Increases penalty applied only in case of others anomalies detected. Enable by default.

Add a significant amount of web scanner User-Agent in bad bot list

Bugs solved :

• My Account / My Organization: Resolved an issue where all users in the organization were displayed as "inactive".

• Dashboard Deployment: Fixed the monthly report email for users who belong to a single organization with multiple clusters.

• In expert mode, certain drives can be configured to immediately trigger a block and an IP ban.

• Enable the NodeJS drive for all sites after several weeks of testing.

• New My Logs filter : Credibility between ... and ...

• 42 new countries available for geoblocking

• New virtual patches : Gitlab CVE-2024-45409, WP - Ninja Forms CVE-2024-7354, Apache OFBIZ CVE-2024-45507

• Certificate Expiration Email: The certificate expiration email now consolidates all sites within an organization with certificates expiring in less than 15 days (previously, one email was sent per site).

• My Logs > Filters:

  • Add/Edit Filter: A new button allows toggling between included and excluded values.

  • Paste Support: You can now paste a list of values separated by commas or semicolons, and they will be correctly processed.

  • Behavior Changes:

    • Duplicate filter values can no longer be added.

    • Switching a filter from "-" to "+" will remove it from the "+" list (enabling quick review of an IP before excluding it).

Improvements of layer 7 DDOS protection

• Redesign of filters in My Logs

• JWT are now decoded and analyzed

• Improvements on command injection detection

Monthly report mail now contains one link per organization-cluster combination

• New virtual patch Apache OFBiz CVE-2024-38856

• New virtual patch ServiceNow CVE-2024-4978, CVE-2024-5217