Google Android 安全漏洞

Google Android is an open source cell phone operating system developed by Google. Google Android suffers from an elevation of privilege vulnerability that stems from an undeclared permission to add an application to bypass a VPN.An attacker can exploit this vulnerability to achieve a local...

CVE-2024-52579 Server-Side Request Forgery vulnerability in various APIs in Misskey

Misskey is an open source, federated social media platform. Some APIs using HttpRequestService do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or...

Fortinet FortiClient 安全漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet...

PT-2024-9235 · Sonicwall · Sonicwall Sma100 Sslvpn

Name of the Vulnerable Software and Affected Versions: SonicWall SMA100 SSLVPN affected versions not specified Description: A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause a stack-based buffer overflow, potentially leading to code execution...

CVE-2018-9487

In setVpnForcedLocked of Vpn.java, there is a possible blocking of internet traffic through vpn due to a bad uid check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation...

PT-2024-10586 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 8.0 Description: A security settings bypass is possible due to a missing permission check in the setAllowOnlyVpnForUids function of NetworkManagementService.java. This could lead to local escalation of privilege,...

D-Link DWR-2000M 安全漏洞

The D-Link DWR-2000M is a wireless router from China's AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DWR-2000M. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to obtain...

DEBIAN-CVE-2024-50342

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port...

PT-2024-34676 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: VPN module affected versions not specified Description: The issue concerns the VPN module where processes are not fully terminated, which can be exploited to affect power consumption. There is no information provided about the estimated numbe...

PT-2024-34677 · Unknown · Vpn Module

Name of the Vulnerable Software and Affected Versions: VPN module affected versions not specified Description: The issue concerns a vulnerability of pop-up windows belonging to no app in the VPN module. Successful exploitation of this vulnerability may affect service confidentiality...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a process legacy in the vpn module. The vulnerability can be exploited by an attacker t...

The vulnerability of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD), web server software-based network devices, allows attackers to execute arbitrary code.

The vulnerability in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD VPN microprogramming device controllers is related to improper code generation. Exploitation of this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability of the microprogrammed software of the SCALANCE M-800 industrial routers stems from incorrect processing of input data in the configuration fields of VPNs. This allows attackers to execute arbitrary code.

The vulnerability of the microprogrammed software of the SCALANCE M-800 industrial routers is related to incorrect processing of input data in the configuration fields of VPNs. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack

Cisco on Wednesday said it has released updates to address an actively exploited security flaw in its Adaptive Security Appliance ASA that could lead to a denial-of-service DoS condition. The vulnerability, tracked as CVE-2024-20481 CVSS score: 5.8, affects the Remote Access VPN RAVPN service of...

CVE-2024-20402

A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This...

CVE-2024-20382

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

CVE-2024-20341

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

NetworkManager-libreswan: Local privilege escalation via leftupdown

A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...

Bohemia and Cannabia Dark Web Markets Taken Down After Joint Police Operation

The Dutch police have announced the takedown of Bohemia and Cannabia, which has been described as the world's largest and longest-running dark web market for illegal goods, drugs, and cybercrime services. The takedown is the result of a collaborative investigation with Ireland, the United Kingdom...

CVE-2024-20513

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to...