Firewall information leak to regular SSL VPN web portal users

A SSL VPN user logged in via the web portal can access internal FortiOS configuration information eg: addresses via specifically crafted URLs...

Cross site scripting

A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...

CVE-2018-0251

A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...

CVE-2018-0227

A vulnerability in the Secure Sockets Layer SSL Virtual Private Network VPN Client Certificate Authentication feature for Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to establish an SSL VPN connection and bypass certain SSL certificate verification steps...

CVE-2018-0251

A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...

Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability

A vulnerability in the Login screen of the Clientless SSL VPN WebVPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Th...

Cisco Adaptive Security Appliance Clientless SSL VPN Cross-Site Scripting Vulnerability

A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...

Pulse Secure Linux client GUI fails to validate SSL certificates

Overview The Pulse Secure Linux client GUI fails to validate SSL certificates, which can allow an attacker to modify connection settings. Description Pulse Secure is an SSL VPN solution. The Linux Pulse Secure client GUI is implemented using WebKit, and the actions taken using the GUI are...

Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability

Summary A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double fr...

Double free

A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a...

CVE-2018-0101

A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a...

CVE-2018-0101

CVE-2018-0101 concerns Cisco ASA webvpn: a double-free in the webvpn component can allow an unauthenticated remote attacker to trigger a reload or execute arbitrary code by sending crafted XML packets to a webvpn-configured interface. Public PoCs and PoC sources exist (exploit-db, GitHub), illust...

CVE-2018-0101

A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a...

CVE-2018-0101

A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

Information disclosure

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

Fortinet FortiOS has an information disclosure vulnerability (CVE-2017-7738) affecting FortiOS 5.6.0–5.6.2, 5.4.0–5.4.5, and 5.2 and earlier. An admin with super_admin privileges can view the SSL VPN web portal session info via the fnsysctl CLI, potentially exposing user credentials. Related advi...

SSL VPN Web Portal user credentials may be leaked to super_admins

An admin user with superadmin privileges i.e. with a superadmin profile may view the current sslvpn web portal session info, using the fnsysctl CLI command. This info includes user credentials...

FortiGate SSL VPN Portal 5.x Cross Site Scripting Vulnerability

FortiGate SSL VPN Portal versions 5.6.2 and below, 5.4.6 and below, 5.2.12 and below, and 5.0 and below suffer from a cross site scripting vulnerability. ======================================================================= title: FortiGate SSL VPN Portal XSS Vulnerability product: Fortinet...