Microsoft Windows Point-to-Point Tunneling Protocol安全漏洞

Microsoft Windows Point-to-Point Tunneling Protocol PPTP is a network protocol from Microsoft that enables the secure transmission of data from remote clients to private corporate servers by creating a virtual private network VPN over a TCP/IP-based data network. VPN. A security vulnerability...

Protect

A permissive list of allowed inputs vulnerability CWE-183 in FortiGate Policy-based NGFW Mode may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal...

PT-2023-7424 · Fortinet · Fortigate +1

Name of the Vulnerable Software and Affected Versions: FortiGate versions 7.2.3 and below FortiGate versions 7.0.9 and below Description: The issue is related to a permissive list of allowed inputs, which may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal...

Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation Exploit

Exploit Title: Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation Exploit Author : TOUHAMI KASBAOUI Vendor Homepage : https://www.forcepoint.com/ Software: Stonesoft VPN Windows Version : 6.2.0 / 6.8.0 Tested on : Windows 10 CVE : N/A Description local privilege escalation vertical...

Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation

Exploit Title: Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation Exploit Author : TOUHAMI KASBAOUI Vendor Homepage : https://www.forcepoint.com/ Software: Stonesoft VPN Windows Version : 6.2.0 / 6.8.0 Tested on : Windows 10 CVE : N/A Description local privilege escalation vertical...

MERCURY and DEV-1084: Destructive attack on hybrid environment

April 2023 update – Microsoft Threat Intelligence has shifted to a new threat actor naming taxonomy aligned around the theme of weather. MERCURY is now tracked as Mango Sandstorm and DEV-1084 is now tracked as Storm-1084. To learn more about the new taxonomy represents the origin, unique traits,...

Free VPN Amnezia Helps Users Avoid Censorship in Russia

Amnezia, a free virtual private network, allows users to set up their own servers, making it harder for Moscow to block this portal to the outside world...

CVE-2023-20128

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilitie...

Input validation

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilitie...

Authorization

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilitie...

CVE-2023-20128 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilitie...

CVE-2023-20128

CVE-2023-20128 affects Cisco Small Business RV320/RV325 Dual Gigabit WAN VPN Routers. The web-based management interface has multiple vulnerabilities due to insufficient validation of user input, allowing an authenticated, remote attacker with valid Administrator credentials to inject and execute...

CVE-2023-20073 Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

CVE-2023-20117

The CVE-2023-20117 entry concerns Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. The vulnerabilities stem from insufficient validation of user-supplied input in the devices’ web-based management interface, enabling an authenticated attacker with valid Administrator credentials...

CVE-2023-20128 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilitie...

New VPN Malvertising Attack Drops OpcJacker Crypto Stealer

By Deeba Ahmed Researchers warned that the campaign works through a network of fake websites that promote seemingly harmless crypto apps and other software. This is a post from HackRead.com Read the original post: New VPN Malvertising Attack Drops OpcJacker Crypto Stealer...

Mullvad VPN and Tor Project Release Mullvad Browser

By Waqas Mullvad VPN and the Tor Project Join Forces to Launch Mullvad Browser, a Privacy-Focused Web Browser. This is a post from HackRead.com Read the original post: Mullvad VPN and Tor Project Release Mullvad Browser...

Mullvad VPN and Tor Project Create New Privacy-Focused Mullvad Browser

Mullvad Browser, a collaboration between the nonprofit and Mullvad VPN, offers an anti-tracking browser designed to be used with a VPN...

Crypto-Stealing OpcJacker Malware Targets Users with Fake VPN Service

A piece of new information-stealing malware called OpcJacker has been spotted in the wild since the second half of 2022 as part of a malvertising campaign. "OpcJacker's main functions include keylogging, taking screenshots, stealing sensitive data from browsers, loading additional modules, and...