8514 matches found
CVE-2022-0517
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN 2.7.1...
CVE-2022-0517
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN 2.7.1...
CVE-2022-0517
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN 2.7.1...
CVE-2020-15679
CVE-2020-15679 describes an OAuth session fixation vulnerability in Mozilla VPN’s login flow. Affected software includes Mozilla VPN iOS up to 1.0.7, Mozilla VPN Windows prior to 1.2.2, and Mozilla VPN Android up to 1.1.0. Root cause: vulnerability in the login process that allows an attacker (sh...
CVE-2022-0517
Mozilla VPN is affected by a local privilege escalation vulnerability where an OpenSSL configuration file can be loaded from an unsecured directory. This allows a user or low-privilege attacker to execute arbitrary code with SYSTEM privileges on affected builds prior to 2.7.1. Remediation is to u...
Virtuozzo Hybrid Infrastructure 5.3 Update 1.1 (5.3.1-41)
This update enables a new scenario for VPN as a service and provides important stability fixes. Vulnerability id: VSTOR-60216, VSTOR-61366 Stability issues for the storage and Backup Gateway services...
Cisco Firepower Threat Defense Software SSL/TLS DoS (cisco-sa-asaftd-sslvpndma-dos-HRrqB9Yx)
A vulnerability in the SSL VPN negotiation process for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to inefficient direct memory access...
Hackers Actively Exploiting Citrix ADC and Gateway Zero-Day Vulnerability
The U.S. National Security Agency NSA on Tuesday said a threat actor tracked as APT5 has been actively exploiting a zero-day flaw in Citrix Application Delivery Controller ADC and Gateway to take over affected systems. The critical remote code execution vulnerability, identified as CVE-2022-27518...
December 13, 2022—KB5021255 (OS Build 22621.963)
None None...
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests...
CVE-2022-42475: Critical Unauthenticated Remote Code Execution Vulnerability in FortiOS; Exploitation Reported
Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. On December 12, 2022, FortiGuard Labs published advisory FG-IR-22-398 regarding a critical CVSSv3 9.3 “heap-based buffer overflow vulnerability CWE-122 in FortiOS SSL-VPN which may all...
Vulnerability fixed in FortiOS SSL-VPN
Fortinet has fixed a vulnerability in FortiOS SSL-VPN. A unauthenticated remote malicious party can exploit the vulnerability exploit it to execute arbitrary code. This requires malicious network traffic must be sent to the vulnerable interface sent. Fortinet says it is aware of an incident in...
Protect
A heap-based buffer overflow vulnerability CWE-122 in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests...
VulnCheck KEV: CVE-2022-42475
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests...
The vulnerability of the SSL-VPN portal for operating systems FortiOS and the proxy server used for protecting against internet attacks by FortiProxy allows attackers to induce a service failure.
The vulnerability of the SSL-VPN portal for FortiOS operating systems and the FortiProxy proxy server used to protect against internet attacks is related to access to an uninitialized pointer. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending a...
Cross site scripting
A cross-site scripting XSS vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an...
CVE-2022-40603
A cross-site scripting XSS vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an...
CVE-2022-40603
The CVE-2022-40603 issue is an XSS vulnerability in the CGI program of Zyxel ZyWALL/USG family devices and related lines (USG, ZyWALL, USG FLEX, VPN, ATP). Affected firmware ranges include ZyWALL/USG 4.30–4.72, VPN 4.30–5.31, USG FLEX 4.50–5.31, and ATP 4.32–5.31. The underlying impact is that an...
