CVE-2023-5748: Buffer Copy without Checking Size of Input

Buffer copy without checking size of input 'Classic Buffer Overflow' vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service attacks via unspecified vectors...

CVE-2022-46783: Inadequate Encryption Strength

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted address book...

PT-2023-15028 · Stormshield · Stormshield Ssl Vpn Client

Name of the Vulnerable Software and Affected Versions: Stormshield SSL VPN Client versions prior to 3.2.0 Description: An issue was discovered in the Stormshield SSL VPN Client. If multiple address books are used, an attacker may be able to access the other encrypted address book. Recommendations...

CVE-2022-46783

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted address book...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

CVE-2022-46782: Undefined Security Weakness

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

CVE-2021-36809

A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client...

CVE-2021-36809

A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client...

CVE-2021-36809

CVE-2021-36809 affects Sophos SSL VPN client. A local attacker with administrator privileges can overwrite arbitrary files on the system via the VPN client’s log handling, potentially causing a denial of service and data loss. Root cause described as a code issue in log path handling/back-end fil...

CVE-2021-36809: Undefined Security Weakness

A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client...

Securepoint SSL VPN Client 2.0.30 Local Privilege Escalation Vulnerability

Securepoint SSL VPN Client version 2.0.30 suffers from a local privilege escalation vulnerability. Local Privilege Escalation in Securepoint SSL VPN Client 2.0.30 Metadata =================================================== Release Date: 29-Jun-2021 Author: Florian Bogner @...

Securepoint SSL VPN Client 2.0.30 Local Privilege Escalation

Local Privilege Escalation in Securepoint SSL VPN Client 2.0.30 Metadata =================================================== Release Date: 29-Jun-2021 Author: Florian Bogner @ https://bee-itsecurity.at Affected product: Securepoint SSL VPN Client Fixed in: version 2.0.32 Tested on: Windows 10 x64...

CVE-2021-35523: Improper Privilege Management

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file tha...

USN-4565-1: OpenConnect vulnerability

It was discovered that OpenConnect has a buffer overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes. An attacker could use it to provoke a denial of service crash...

CVE-2018-13283

CVE-2018-13283 affects the Synology SSL VPN Client before 1.2.5-0226. A vulnerability in client.cgi allows remote attackers to perform man-in-the-middle attacks using manipulated command, hostname, or port parameters. Impact per NVD is high (CVSS v3.0: 7.4) with high confidentiality and integrity...

CVE-2018-13283: Lack of Administrator Control over Security

Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the 1 command, 2 hostname, or 3 port parameter...

CVE-2018-8929

Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote attackers to conduct man-in-the-middle attacks via a crafted payload...

CVE-2018-8929

Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote attackers to conduct man-in-the-middle attacks via a crafted payload...

CVE-2018-8929: Cleartext Transmission of Sensitive Information

Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote attackers to conduct man-in-the-middle attacks via a crafted payload...