Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability

A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN ISM-VPN running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service DoS condition...

MvpnExcludeDomains fails to take effect on iOS when using Citrix WebSSO micro VPN with Microsoft Endpoint Manager MAM (Intune)

Microsoft Edge or Citrix Secure Mail for iOS is configured with 'MvpnExcludeDomains'. When a user browses to a website that is listed under'MvpnExcludeDomains', the traffic is still sent through Citrix Gateway. This traffic is instead expected to be sent directly to the website not through Citrix...

The vulnerability of Mozilla VPN’s network software lies in the ability to load the OpenSSL configuration file from an unprotected directory, allowing an attacker to execute arbitrary code with SYSTEM privileges.

The vulnerability of Mozilla VPN’s network software relates to the possibility of loading the OpenSSL configuration file from an unprotected directory. Exploiting this vulnerability could allow a hacker to execute arbitrary code with SYSTEM privileges...

4 Benefits of Cloud VPN to your Business

By Owais Sultan Cloud computing is a well-known technology now, and some companies are already using more cloud-based services than hardware-based… This is a post from HackRead.com Read the original post: 4 Benefits of Cloud VPN to your Business...

Mozilla Releases Security Update for Mozilla VPN

Mozilla has released a security update to address a vulnerability in Mozilla VPN. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Mozilla Foundation Security Advisory 2022-08 and make the necessary update. This...

CVE-2021-26092

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to...

CVE-2021-26092

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to...

CVE-2021-26092

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to...

CVE-2021-26092

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to...

CVE-2021-26092

CVE-2021-26092 affects Fortinet FortiGate SSL VPN portal and FortiProxy, where input is not sanitized, enabling a remote unauthenticated attacker to perform a reflected XSS via malicious GET parameters on the error page. Affected FortiGate FortiOS versions span 5.2.x to 6.4.x and FortiProxy 1.2.x...

PT-2022-1721 · Mozilla · Vpn

Name of the Vulnerable Software and Affected Versions: Mozilla VPN versions prior to 2.7.1 Description: The issue is related to Mozilla VPN's ability to load an OpenSSL configuration file from an unsecured directory. This could allow a user or attacker with limited privileges to launch arbitrary...

Mozilla VPN local privilege escalation vis uncontrolled OpenSSL search path — Mozilla

Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege...

GE Proficy CIMPLICITY-IPM

1. EXECUTIVE SUMMARY CVSS v3 7.5 Vendor: GE Equipment: Proficy CIMPLICITY Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve both code execution and local privilege escalation. 3. TECHNICAL DETAILS 3.1...

HMA VPN 5.3 - Unquoted Service Path

Exploit Title: HMA VPN 5.3 - Unquoted Service Path Date: 18/02/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.hidemyass.com/ Software Link: https://www.hidemyass.com/en-us/downloads Version: 5.3.5913.0 Tested: Windows 10 Pro x64 es C:\Users\saudhsc qc HmaProVpn SC QueryServiceConf...

HMA VPN 5.3 - Unquoted Service Path Vulnerability

Exploit Title: HMA VPN 5.3 - Unquoted Service Path Exploit Author: Saud Alenazi Vendor Homepage: https://www.hidemyass.com/ Software Link: https://www.hidemyass.com/en-us/downloads Version: 5.3.5913.0 Tested: Windows 10 Pro x64 es C:\Users\saudhsc qc HmaProVpn SC QueryServiceConfig SUCCESS...

HMA VPN 5.3 Unquoted Service Path

Exploit Title: HMA VPN 5.3 - Unquoted Service Path Date: 18/02/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.hidemyass.com/ Software Link: https://www.hidemyass.com/en-us/downloads Version: 5.3.5913.0 Tested: Windows 10 Pro x64 es C:\Users\saudhsc qc HmaProVpn SC QueryServiceConf...

4 best practices to implement a comprehensive Zero Trust security approach

Today’s threat actors don’t see barriers, they see opportunities. As the old firewalls protecting the corporate network become obsolete amid the rush to adopt a hybrid workspace, implementing Zero Trust security has become an imperative across all sectors, both public and private. During this tim...

H3C SSL VPN - Username Enumeration

Exploit Title: H3C SSL VPN - Username Enumeration Exploit Author: LiquidWorm H3C SSL VPN Username Enumeration Vendor: Hangzhou H3C Technologies Co. | New H3C Technologies Co., Ltd. Product web page: https://www.h3c.com Affected version: n/a Summary: H3C SSL VPN is a secure VPN system based on SSL...

SafeDNS: Cloud-based Internet Security and Web Filtering Solution for MSPs

Remote workplace trend is getting the upper hand in 2022. A recent survey by IWG the International Workplace Group determined that 70% of the world's professionals work remotely at least one day a week, with 53% based outside their workplace at least half of the week. Taking this into...

Wazawaka Goes Waka Waka

In January, KrebsOnSecurity examined clues left behind by "Wazawaka," the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since "lost his mind" according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a...