[Security Nation] Omer Akgul and Richard Roberts on YouTube VPN Ads

!\Security Nation\ Omer Akgul and Richard Roberts on YouTube VPN Adshttps://blog.rapid7.com/content/images/2022/05/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with academics Omer Akgul and Richard Roberts about their recent paper, “Investigating Influencer VPN Ads ...

Cisco Firepower Threat Defense Software Web Services Interface DoS (cisco-sa-asafdt-webvpn-dos-tzPSYern)

A vulnerability in the web services interface for remote access VPN features of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to improper input validation when parsing HTTPS request...

Cisco Adaptive Security Appliance Software Web Services Interface DoS (cisco-sa-asafdt-webvpn-dos-tzPSYern)

A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to improper input validation when parsing HTTPS...

CVE-2022-26532

CVE-2022-26532 is a local command-injection vulnerability in Zyxel devices’ packet-trace CLI, affecting USG/ZyWALL family firmwares 4.09–4.71, USG FLEX 4.50–5.21, ATP 4.32–5.21, VPN 4.30–5.21, NSG 1.00–1.33 Patch 4, NXC2500 6.10 AAIG.3 and earlier, NAP203 6.25 ABFA.7 and earlier, NWA50AX 6.25 ABY...

CVE-2022-0910

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware...

CVE-2022-0910

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware...

CVE-2022-0910

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware...

Authentication flaw

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware...

CVE-2022-0910

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware...

CVE-2022-0910

CVE-2022-0910 describes an authentication-bypass flaw in Zyxel firewall products where an authenticated attacker can downgrade from two-factor to one-factor authentication when connecting to the IPsec VPN server. Affected are Zyxel USG/ZyWALL firmware 4.32–4.71, USG FLEX 4.50–5.21, ATP 4.32–5.21,...

CVE-2022-0734

CVE-2022-0734 describes a cross-site scripting vulnerability in Zyxel USG/ZyWALL CGI programs across multiple firmware lines (USG/ZyWALL 4.35–4.70, USG FLEX 4.50–5.20, ATP 4.35–5.20, VPN 4.35–5.20). The issue allows a malicious script to access information stored in a user’s browser, such as cook...

CVE-2022-26531

CVE-2022-26531 stems from multiple improper input validation flaws in Zyxel devices (USG/ZyWALL, USG FLEX, ATP, VPN, NSG, NXC2500, NAP203, NWA50AX, WAC500, WAX510D) across firmware ranges up to 4.71/5.21/6.x, enabling a local authenticated attacker to trigger a buffer overflow or system crash via...

CVE-2022-26634

HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level...

CVE-2022-26634

HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level...

Code injection

HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level...

CVE-2022-26634

HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level...

CVE-2022-26634

CVE-2022-26634 affects HMA VPN v5.3.5913.0 through an unquoted service path that allows local privilege escalation to SYSTEM. Red Hat and other sources corroborate the same description; no fixed version is specified in the provided documents. Remediation details are not stated in the given materi...

PT-2022-17968 · Hma Vpn · Hma Vpn

Name of the Vulnerable Software and Affected Versions: HMA VPN version 5.3.5913.0 Description: The issue allows attackers to escalate privileges to the system level due to an unquoted service path in HMA VPN. Recommendations: For HMA VPN version 5.3.5913.0, update to a newer version that contains...

HMA VPN代码问题漏洞

HMA VPN is a VPN software from HMA UK. A security vulnerability exists in HMA VPN version 5.3.5913.0, which stems from the inclusion of an unreferenced service path that allows an attacker to elevate privileges to the system level...

Zyxel Firewall SetWanPortSt command injection

Added: 05/20/2022 Background Zyxel Firewalls are a business solution providing protection from malware and unauthorized access. Problem Zyxel USG FLEX, ATP series, and VPN series firewalls are affected by a vulnerability in the SetWanPortSt command which could allow an attacker to inject arbitrar...