CVE-2025-1566

DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions...

CVE-2025-1566

DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions...

CVE-2025-1566

Google ChromeOS experiences a DNS Leak vulnerability in the Native System VPN within the Dev Channel . Specifically, the system fails to properly tunnel DNS traffic during VPN state transitions , which allows network observers to expose plaintext DNS queries . This issue has been identified in ve...

CVE-2025-1566

DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions...

CVE-2025-1566

DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions...

CVE-2025-32787 SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in DeleteIPv6DefaultRouterInRA called by StorePacket. Before dereferencing, DeleteIPv6DefaultRouterInRA does not account for ParsePacket returning NULL,...

CVE-2025-32787 SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in DeleteIPv6DefaultRouterInRA called by StorePacket. Before dereferencing, DeleteIPv6DefaultRouterInRA does not account for ParsePacket returning NULL,...

Informatica: [███] Cross-Site Scripting (XSS) via /ssl-vpn/getconfig.esp at GlobalProtect VPN Portal

A Cross-Site Scripting XSS vulnerability was discovered in the GlobalProtect VPN portal's getconfig.esp endpoint. The vulnerability existed because the application reflected user input from the user parameter in an XML response without proper sanitization. This allowed an attacker to inject SVG...

NetScaler: Troubleshooting SSO Failures Over VPN Mode

SSO failures over VPN mode on NetScaler can often be traced to limitations in HTTPS inspection, misconfigured session or traffic policies, or incomplete authentication setups. By carefully reviewing these areas—especially the VPN mode, session policies, and authentication flow—you can...

Google Chrome OS security vulnerabilities

Google Chrome OS is a lightweight, open source, web-based operating system from Google. Google Chrome OS suffers from an information disclosure vulnerability that stems from a failure to properly tunnel DNS traffic during VPN state transitions, for which no detailed vulnerability details are...

CVE-2025-1566: Improper Protection against Electromagnetic Fault Injection (EM-FI)

DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions...

PT-2025-16919 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Google ChromeOS version 129.0.6668.36 Description: The issue allows network observers to expose plaintext DNS queries due to a failure to properly tunnel DNS traffic during VPN state transitions. This occurs in the Native System VPN in Google...

PT-2025-16907 · Unknown · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEtherVPN versions 5.02.5184 through 5.02.5187 Description: The issue is related to a NULL dereference in the DeleteIPv6DefaultRouterInRA function called by StorePacket. This occurs because DeleteIPv6DefaultRouterInRA does not account for...

PT-2025-36: Local Privilege Escalation (LPE) in Amnezia VPN

The vulnerability was identified in Amnezia VPN, versions to 4.8.6.0, on MacOS. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 12.04.2025 Recommendations: Update to...

Advisory ROSA-SA-2025-2808

Software: libreswan 4.12 OS: ROSA Virtualization 3.0 packageevrstring: libreswan-4.12-2.rv30.4 CVE-ID: CVE-2024-2357 BDU-ID: 2024-03242 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the VPN protocol library using "IPsec" libreswan is related to the use of the PreSharedKey secret to create an AUTH...

Fortinet Warns Attackers Retain FortiGate Access Post-Patching via SSL-VPN Symlink Exploit

Fortinet has revealed that threat actors have found a way to maintain read-only access to vulnerable FortiGate devices even after the initial access vector used to breach the devices was patched. The attackers are believed to have leveraged known and now-patched security flaws, including, but not...

Fortinet Releases Advisory on New Post-Exploitation Technique for Known Vulnerabilities

Fortinet is aware of a threat actor creating a malicious file from previously exploited Fortinet vulnerabilities CVE-2024-21762, CVE-2023-27997, and CVE-2022-42475 within FortiGate products. This malicious file could enable read-only access to files on the device's file system, which may include...

CVE-2023-37930

Multiple issues including the use of uninitialized ressources CWE-908 and excessive iteration CWE-834 vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests...

📄 Cosy+ 21.2s7 Command Injection

Cosy+ firmware version 21.2s7 command injection proof of concept exploit. Hey, Overview: The Ewon Cosy+ is a VPN gateway used for remote access and maintenance in industrial environments. The manufacturer describes the product as follows see 1: "The Ewon Cosy+ gateway establishes a secure VPN...

CVE-2023-37930

Multiple issues including the use of uninitialized ressources CWE-908 and excessive iteration CWE-834 vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests...