TOTOLINK X2000R security vulnerabilities

TOTOLINK X2000R is a WiFi 6 router from China's Gion Electronics that supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion capabilities. The TOTOLINK X2000R suffers from a cross-site scripting vulnerability that stems from the lack of effective...

CVE-2024-28403

TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting XSS via the VPN Page...

CVE-2024-28403: Improper Neutralization of Input During Web Page Generation

TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting XSS via the VPN Page...

CVE-2024-28403

TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting XSS via the VPN Page...

CVE-2024-28403

TOTOLINK X2000R (before V1.0.0-B20231213.1013) is vulnerable to Cross Site Scripting (XSS) via the VPN Page. The root cause cited is lack of proper filtering/escaping of user-supplied data on the VPN Page. No remediation or fix version is specified in the provided documents. Exploitation details ...

Fortinet FortiOS Out-Of-Bounds Write

CVE-2024-21762 out-of-bounds write in Fortinet FortiOS CVE-2024-21762 vulnerability Vulnerability ===== FortiGate released a version update in February, fixing multiple medium- and high-risk vulnerabilities. One of the severe-level vulnerabilities is an unauthorized out-of-bounds write...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check Chequea si t...

ROS-2-511

2.511 OpenVPN Authentication Bypass CVE-2020-15078 1. Vulnerability Description: The vulnerability allows a remote attacker to bypass authentication and access restrictions to leak VPN configuration data. The issue only occurs on servers that are configured to use deferredauth. Under certain...

Siemens SINEMA Remote Connect Client Information Disclosure Vulnerability

SINEMA Remote Connect is a management platform for remote networks that makes it simple to manage tunneled connections VPN between headquarters, service technicians and installed machines or plants. An information disclosure vulnerability exists in Siemens SINEMA Remote Connect Client, which can ...

CVE-2024-23112

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

CVE-2024-23112

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

Authorization

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

CVE-2024-23112

This CVE affects Fortinet FortiOS and FortiProxy SSL-VPN bookmarks. Affected components are the SSL-VPN bookmark handling, where an authenticated attacker may bypass authorization via URL manipulation to access another user’s bookmarks. Affected FortiOS/ FortiProxy versions include: FortiOS 6.4.7...

CVE-2024-23112

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

CVE-2024-23112

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

Cisco Secure Client Flaw Enables Attackers To Steal VPN Sessions

Summary: A high severity vulnerability tracked as CVE-2024-20337 have been addressed by Cisco affecting its Secure Client software that could allow a threat actor to start a VPN session with the targeted user. Threat Level - Red | Vulnerability Report For a detailed threat advisory, download the...

PT-2024-2259

Name of the Vulnerable Software and Affected Versions TOTOLINK X2000R versions prior to V1.0.0-B20231213.1013 Description The issue is related to the lack of protection for the web page structure when handling the Comment input field, allowing a remote attacker to conduct cross-site scripting...

CVE-2024-23112: Authorization Bypass Through User-Controlled Key

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

Fortinet Fortigate Authorization bypass in SSLVPN bookmarks (FG-IR-24-013)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-013 advisory. - An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0...

Magnet Goblin Hacker Group Leveraging 1-Day Exploits to Deploy Nerbian RAT

A financially motivated threat actor called Magnet Goblin is swiftly adopting one-day security vulnerabilities into its arsenal in order to opportunistically breach edge devices and public-facing services and deploy malware on compromised hosts. "Threat actor group Magnet Goblin's hallmark is its...