CVE-2023-28461

CVE-2023-28461 affects Array Networks ArrayOS Array AG Series and vxAG (≤ 9.4.0.481). The vulnerability allows unauthenticated remote code execution by exploiting a flag in an HTTP header to browse the device filesystem and reach a vulnerable URL. PTSecurity notes evidence of active exploitation;...

Citrix Addresses Auth bypass Flaws Affecting ADC and Gateway Products

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Citrix has addressed bugs in Citrix ADC and Citrix Gateway. A remote intruder could exploit either of these flaws to obtain control of a susceptible system. To successfully exploit the vulnerabili...

Vulnerabilities fixed in Citrix Gateway and Citrix ADC

Citrix has fixed vulnerabilities in Citrix Gateway and Citrix ADC. A malicious party could exploit the vulnerabilities to circumvent security measures via bypassing authentication, security measures, or through brute-force methods, gain access to user environments. The vulnerability with referenc...

Design/Logic Flaw

A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device or to obtain portion...

CVE-2022-20737: Heap-based Buffer Overflow

A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device or to obtain portion...

CVE-2021-22955

A unauthenticated denial of service vulnerability exists in Citrix ADC 13.0-83.27, 12.1-63.22 and 11.1-65.23 when configured as a VPN Gateway or AAA virtual server could allow an attacker to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication...

Denial of service

A unauthenticated denial of service vulnerability exists in Citrix ADC 13.0-83.27, 12.1-63.22 and 11.1-65.23 when configured as a VPN Gateway or AAA virtual server could allow an attacker to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication...

Weak Password Vulnerability in Neusoft NetEye VPN Gateway System

Neusoft NetEye VPN gateway system is a professional VPN device, which adopts standard SSL and TLS protocols, and supports IPSec VPN and SSLVPN at the same time, and is not a plug-in card or firewall with VPN module device. Neusoft NetEye VPN gateway system has a weak password vulnerability, which...

Weak password vulnerability in Huawei SVN2230

The Huawei SVN2230 is a VPN gateway. The Huawei SVN2230 suffers from a weak password vulnerability that can be exploited by an attacker to obtain sensitive information...

Command Execution Vulnerability in DrayTek Vigor2960 (CNVD-2021-28719)

Vigor2960 is a load balancing router and VPN gateway appliance from DrayTek Taiwan, China. The DrayTek Vigor2960 suffers from a command execution vulnerability that can be exploited by an attacker to gain ROOT privileges...

DrayTek Vigor2960, Vigor3900, and Vigor300B Flush Zone Overflow Vulnerability

DrayTek Vigor3900 and others are products of DrayTek Taiwan, China.DrayTek Vigor3900 is a broadband router/VPN gateway appliance.Vigor2960 is a load-balancing router and VPN gateway appliance.Vigor300B is a load-balancing router. A buffer overflow vulnerability exists in the DrayTek Vigor2960,...

Hackers Exploit Zero-Day Bugs in Draytek Devices to Target Enterprise Networks

Cybersecurity researchers with Qihoo 360's NetLab today unveiled details of two recently spotted zero-day cyberattack campaigns in the wild targeting enterprise-grade networking devices manufactured by Taiwan-based DrayTek. According to the report, at least two separate groups of hackers exploite...

CVE-2019-15704

A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway...

Information disclosure

A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway...

CVE-2019-15704

A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway...

CVE-2019-15704

A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway...

CVE-2019-15704

Fortinet FortiClient for macOS is affected by a local information-disclosure vulnerability in which plaintext-sensitive data logged to the console can be read by an attacker when connecting to an SSL VPN Gateway. Affected component is FortiClient for macOS; root cause involves storing sensitive i...

CVE-2019-15704: Missing Encryption of Sensitive Data

A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway...

Time to Transfer Risk: Why Security Complexity & VPNs Are No Longer Sustainable

We all heed the gospel of patching, but as recent incidents made clear, even cutting-edge disruptors struggle to patch everything, everywhere, and all the time. Maybe this is associated with the growing volume of common vulnerabilities and exposures CVEs. As they say, there is only one way and...

Command Execution Vulnerability in Internet Behavior Management System ANYSEC-M6100

The ANYSEC-M6100 is a standard 1U rack mount VPN security access gateway. The ANYSEC-M6100 suffers from a command execution vulnerability. It allows an attacker to remotely execute commands to gain server rights...