Cisco AnyConnect VPN 安全漏洞

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a security vulnerability that stems from a weak entropy value of the handler used in the VPN...

Cisco Meraki Z和Cisco Meraki MX 缓冲区错误漏洞

The Cisco Meraki Z and Cisco Meraki MX are both products of Cisco, Inc.The Cisco Meraki Z is an enterprise-class firewall, VPN gateway, and router.The Cisco Meraki MX is a multifunction security and SD-WAN enterprise appliance. A buffer error vulnerability exists in the Cisco Meraki Z and Cisco...

Cisco AnyConnect VPN 缓冲区错误漏洞

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a buffer error vulnerability that stems from a weak entropy value of the handler used in the VPN...

PT-2024-18669 · Cisco · Cisco Meraki Z Series Teleworker Gateway +2

Name of the Vulnerable Software and Affected Versions: Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices affected versions not specified Description: The issue is due to insufficient validation of client-supplied parameters while establishing an SSL VPN session. An attacker cou...

OESA-2024-2198 python-Flask-Cors security update

A Flask extension for handling Cross Origin Resource Sharing CORS, making cross-origin AJAX possible. Security Fixes: A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option...

CLSA-2024-1727374287 python3.9: Fix of CVE-2024-4032

CVE-2024-4032: fix missing and incorrect ip address ranges in privatenetwork variables...

TheGreenBow Windows Certified VPN Client 安全漏洞

TheGreenBow Windows Certified VPN Client is a client VPN from TheGreenBow. A security vulnerability exists in TheGreenBow Windows Certified VPN Client. A remote attacker could exploit the vulnerability to execute arbitrary code via the IKEv2 authentication phase...

TeamViewer 安全漏洞

TeamViewer is software from TeamViewer, Inc. for remote access as well as remote control and remote maintenance of computers and other end devices. A security vulnerability exists in versions of TeamViewer prior to 15.58.4 that stems from improper cryptographic signature verification when...

CVE-2024-44165

A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7, iOS 17.7 and iPadOS 17.7, visionOS 2, iOS 18 and iPadOS 18, macOS Sonoma 14.7, macOS Sequoia 15. Network traffic may leak outside a VPN tunnel...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS version 13.7, which originates from network traffic that may leak outside of a VPN tunnel...

PT-2024-31000 · Apple · Visionos +6

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7 iOS versions prior to 17.7 iPadOS versions prior to 17.7 visionOS versions prior to 2 macOS Sonoma versions prior to 14.7 macOS Sequoia versions prior to 15 Description: A logic issue was addressed with improved...

CVE-2024-43798

Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented AUTH environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is...

CVE-2024-43798 Chisel AUTH environment variable not respected in server entrypoint

Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented AUTH environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is...

CVE-2024-43798

CVE-2024-43798 affects Chisel, a fast TCP/UDP tunnel over HTTP secured via SSH. The vulnerability occurs because the server does not read the documented AUTH environment variable for credentials, allowing any unauthenticated user to connect even when credentials are set. This impacts deployments ...

CVE-2024-43798 Chisel AUTH environment variable not respected in server entrypoint

Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented AUTH environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is...

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security...

GHSA-HXWH-JPP2-84PM Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security...

PYSEC-2024-260

Withdrawn as duplicate of PYSEC-2024-71. A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant...

DEBIAN-CVE-2024-6221

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

PYSEC-2024-71

A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant...