CVE-2025-26168: Incorrect Permission Assignment for Critical Resource

IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, ca...

CVE-2025-26169: Incorrect Permission Assignment for Critical Resource

IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be...

CVE-2025-26169

IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be...

Domain passthrough with ZeroTrust VPN users get "cannot start your session" via Azure load balancer

When you access Store URL and click on "Log on" you see the error - cannot start your session. wait a few minutes and try to logon again. If you still experience problems, contact your help desk. When you click on the "OK" button multiple times, eventually it goes away. More details on deployment...

Iranian Hackers Maintain 2-Year Access to Middle East CNI via VPN Flaws and Malware

An Iranian state-sponsored threat group has been attributed to a long-term cyber intrusion aimed at a critical national infrastructure CNI entity in the Middle East that lasted nearly two years. The activity, which lasted from at least May 2023 to February 2025, entailed "extensive espionage...

SonicWall Secure Mobile Access < 10.2.1.10-62sv (SNWLID-2023-0018)

The version of SonicWall Secure Mobile Access installed on the remote host is prior to 10.2.1.10-62sv. It is, therefore, affected by multiple vulnerabilities as referenced in the SNWLID-2023-0018 advisory: - Improper neutralization of special elements in the SMA100 SSL-VPN management interface...

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user...

OpenVPN TLS-crypt-v2 DoS

The vulnerability of the TLS-crypt-v2 function in the OpenVPN software server is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

VulnCheck KEV: CVE-2023-44221

SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user...

Security Bulletin: IBM Technical Suppport Appliance - possible security flaw in DHCP processing that may leak and disrupt network traffic

Summary A flaw in the network manager may cause network traffic to be read and possibly modified when it was expected that the network traffic was protected by a VPN. Vulnerability Details CVEID:CVE-2024-3661 DESCRIPTION: DHCP can add routes to a client’s routing table via the classless static...

Windscribe Acquitted on Charges of Not Collecting Users’ Data

The company doesn't keep logs, so couldn't turn over data: Windscribe, a globally used privacy-first VPN service, announced today that its founder, Yegor Sak, has been fully acquitted by a court in Athens, Greece, following a two-year legal battle in which Sak was personally charged in connection...

Court Dismisses Criminal Charges Against VPN Executive, Affirms No-Log Policy

Toronto, Canada, 28th April 2025, CyberNewsWire...

CVE-2025-1566

DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions...

Vulnerability fixed in SonicWall SonicOS

SonicWall has fixed a vulnerability in SonicOS. The vulnerability is in how SonicOS' SSLVPN Virtual Office interface functions. An unauthenticated malicious person could exploit this vulnerability, which could result in a firewall crash. This could result in a Denial-of-Service DoS situation,...

Google Chrome OS Information Disclosure Vulnerability (CNVD-2025-09152)

Google Chrome OS is a lightweight, open source, web-based operating system from Google. Google Chrome OS suffers from an information disclosure vulnerability that stems from a failure to properly tunnel DNS traffic during VPN state transitions, for which no detailed vulnerability details are...

ALBEDO Telecom Net.Time - PTP/NTP clock

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

SonicWALL SonicOS SSLVPN code-related vulnerabilities

SonicWALL SonicOS SSLVPN is a virtual private network for secure remote access from SonicWALL USA. A code issue vulnerability exists in SonicWALL SonicOS SSLVPN that originates from a null pointer dereference in the SSLVPN virtual office interface, which could result in a denial of service...

Red Shield VPN Privilege Escalation

The vulnerability of the Red Shield VPN client client is related to insecure management of privileges. Exploiting this vulnerability could allow attackers to enhance their privileges...

SonicWall NetExtender Windows client Privilege Mismanagement Vulnerability

SonicWall NetExtender Windows client is a Windows-based SSL VPN Virtual Private Network client application from SonicWALL USA. A privilege mismanagement vulnerability exists in the SonicWall NetExtender Windows client, which can be exploited by an attacker to modify the configuration and elevate...

PT-2025-17338

Name of the Vulnerable Software and Affected Versions Speedify VPN versions up to 15.0.0 Speedify VPN version 15.4.1 Description A command injection flaw exists in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN. This issue allows attackers to execute arbitrary commands with...