PT-2025-24717

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4 and earlier FortiOS versions 7.0 and earlier FortiOS versions 7.2 and earlier FortiOS versions 7.4.7 and earlier FortiOS version 7.6.0 Description The issue allows an authenticated user to access full SSL-VPN settings via ...

CVE-2024-50562: Insufficient Session Expiration

An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session...

PT-2025-24711 · Fortinet · Forticlient

Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientWindows versions 7.0 through 7.2.6 Fortinet FortiClientWindows version 7.4.0 Description: The issue is related to an improper validation of certificates with host mismatch, allowing an unauthorized attacker to redirect VPN...

Insufficient Session Expiration in SSL-VPN cookie

...

CVE-2024-54019: Improper Validation of Certificate with Host Mismatch

A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow an unauthorized attacker to redirect VPN connections via DNS spoofing or another form of redirection...

PT-2025-24709 · Fortinet · Fortios Ssl-Vpn +1

Name of the Vulnerable Software and Affected Versions: FortiOS SSL-VPN versions 7.6.0, 7.4.6 and below, 7.2.10 and below, 7.0 all versions, 6.4 all versions Description: The issue is related to an Insufficient Session Expiration, which may allow an attacker with a cookie used to log in to the...

CVE-2025-25250: Exposure of Sensitive Information to an Unauthorized Actor

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability CWE-200 vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full...

Why It’s Time to Retire Traditional VPNs, Part 1

...

PT-2025-74: Local Privilege Escalation (LPE) in Mozilla VPN

The vulnerability was identified in Mozilla VPN, versions 2.27.0 on MacOS. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 04.06.2025 Recommendations: Update to version...

PT-2025-25208 · Mozilla · Vpn

Name of the Vulnerable Software and Affected Versions: Mozilla VPN versions 2.28.0 and earlier macOS Description: A vulnerability in Mozilla VPN for macOS allows privilege escalation from a normal user to root. This issue only affects Mozilla VPN on macOS, with other operating systems being...

Security Issue fixed in Mozilla VPN for macOS v2.28.0 — Mozilla

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root.This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected...

PT-2025-49167

Name of the Vulnerable Software and Affected Versions WatchGuard Mobile VPN with SSL Client versions 12.0 through 12.11.2 Description The WatchGuard Mobile VPN with SSL Client on Windows contains a flaw due to insufficient input validation at the control level. This allows a locally authenticated...

Chinese-Owned VPNs

One one my biggest worries about VPNs is the amount of trust users need to place in them, and how opaque most of them are about who owns them and what sorts of data they retain. A new study found that many commercials VPNS are often surreptitiously owned by Chinese companies. It would be hard for...

Arbitrary File Read Vulnerability in SSL VPN of Beijing NetGuard Nebula Information Technology Co.

Beijing Netnifty Information Technology Co., Ltd. is a leading enterprise in the domestic information security industry, specializing in the research, development, production and sales of information security products. Beijing NetGuard Nebula Information Technology Co. Ltd NetGuard Nebula-SSL-VPN...

Hackers Use Fake VPN and Browser NSIS Installers to Deliver Winos 4.0 Malware

Cybersecurity researchers have disclosed a malware campaign that uses fake software installers masquerading as popular tools like LetsVPN and QQ Browser to deliver the Winos 4.0 framework. The campaign, first detected by Rapid7 in February 2025, involves the use of a multi-stage, memory-resident...

Understanding the Relationship between Personal Data Privacy Literacy and Data Privacy Information Sharing by University Students

With constant threats to the safety of personal data in the United States, privacy literacy has become an increasingly important competency among university students, one that ties intimately to the information sharing behavior of these students. This survey based study examines how university...

CVE-2024-20500

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device. This vulnerability is due to insufficient resource...

CVE-2024-20513

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to...

CVE-2024-20502

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to insufficient resource management while establishi...

CVE-2024-20509

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service DoS condition for individual users of the AnyConnect VPN...