Input validation

A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

Input validation

A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code or cause the web-based management process on the device to restart unexpectedly,...

Chinese Hackers Exploited Recent Fortinet Flaw as 0-Day to Drop Malware

A suspected China-nexus threat actor exploited a recently patched vulnerability in Fortinet FortiOS SSL-VPN as a zero-day in attacks targeting a European government entity and a managed service provider MSP located in Africa. Telemetry evidence gathered by Google-owned Mandiant indicates that the...

TOTOLINK A7100RU 操作系统命令注入漏洞

The TOTOLINK A7100RU is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOlink A7100RU V7.4cu.2313B20191024 version, which stems from a command injection issue contained in the password parameter of the...

CVE-2022-48126

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function...

PT-2023-15584 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 B20191024 Description: A command injection issue was discovered via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function. This allows for potential exploitation. Recommendations: For...

CVE-2023-20007

A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code or cause the web-based management process on the device to restart unexpectedly,...

CVE-2023-20007

Cisco CVE-2023-20007 affects the web-based management interfaces of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers. The root cause is insufficient validation of user-supplied input to the web UI, exploitable by an authenticated attacker using crafted HTTP input...

CVE-2023-20045

A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

CVE-2023-20045

CVE-2023-20045 affects Cisco Small Business RV160/RV260 Series VPN Routers. The issue is in the web-based management interface due to insufficient input validation. An authenticated attacker with Administrator-level credentials can remotely send a crafted request to execute arbitrary commands wit...

Beware: Tainted VPNs Being Used to Spread EyeSpy Surveillanceware

Tainted VPN installers are being used to deliver a piece of surveillanceware dubbed EyeSpy as part of a malware campaign that started in May 2022. It uses "components of SecondEye – a legitimate monitoring application – to spy on users of 20Speed VPN, an Iranian-based VPN service, via trojanized...

CVE-2023-22417

A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon flowd of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service DoS. In an IPsec VPN environment, a memory leak will be seen if a DH or ECDH group is...

Design/Logic Flaw

A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon flowd of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service DoS. In an IPsec VPN environment, a memory leak will be seen if a DH or ECDH group is...

Update now! Patch Tuesday January 2023 includes one actively exploited vulnerability

The first Microsoft Patch Tuesday of 2023 is an important one to start of the year with. In total 98 vulnerabilities were patched, including 11 that were labelled critical and one that is being actively exploited in the wild. This is also the last time we expect to see fixes for Windows 8.1...

CVE-2023-22417 Junos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crash

A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon flowd of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service DoS. In an IPsec VPN environment, a memory leak will be seen if a DH or ECDH group is...

CVE-2023-22417

CVE-2023-22417 affects Juniper Networks Junos OS on SRX Series, where the Flow Processing Daemon (flowd) can leak memory in IPsec VPN scenarios when DH/ECDH groups are configured, potentially crashing the flowd process and causing DoS. Affected versions include SRX/JunOS releases prior to the fix...

CVE-2023-22417 Junos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crash

A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon flowd of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service DoS. In an IPsec VPN environment, a memory leak will be seen if a DH or ECDH group is...

Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Remote Code Execution and Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code or cause the web-based management process on the device to restart unexpectedly,...

Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

Schneider Electric EcoStruxure Control Expert, Process Expert, Modicon M340, M580 and M580 CPU (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely Vendor: Schneider Electric Equipment: EcoStruxure Control Expert, EcoStruxure Process Expert, Modicon M340 CPU, Modicon M580 CPU, Modicon Momentum Unity M1E Processor, Modicon MC80 Vulnerability: Authentication Bypass by...