Milesight VPN security vulnerability

Milesight VPN is a web-based VPN monitoring and management platform from China-based Milesight. A security vulnerability exists in Milesight VPN v2.0.2. An attacker can exploit this vulnerability to cause arbitrary Javascript code injection via a specially crafted HTTP request...

Milesight VPN security vulnerability

Milesight VPN is a web-based VPN monitoring and management platform from China-based Milesight. A security vulnerability exists in Milesight VPN v2.0.2. An attacker can exploit this vulnerability to cause arbitrary Javascript code injection via a specially crafted HTTP request...

Milesight VPN SQL Injection Vulnerability

Milesight is a complete Artificial Intelligence Video Surveillance solution from China's StarZone IOT Milesight. A SQL injection vulnerability exists in Milesight VPN version v2.0.2. An attacker exploits the vulnerability to cause authentication bypass via a specially crafted web request...

Milesight VPN security vulnerability

Milesight VPN is a web-based VPN monitoring and management platform from China-based Milesight. A security vulnerability exists in Milesight VPN version v2.0.2, which stems from an authentication bypass vulnerability, where a specially crafted web request could lead to authentication bypass...

Milesight UR32L Trust Management Vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A misconfiguration vulnerability in the Milesight UR32L urvpnclient feature can be exploited by an attacker to perform a man-in-the-middle attack resulting in elevated privileges...

PT-2023-8306 · D Link · D-Link Dir-X3260

Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in the prog.cgi component of D-Link DIR-X3260 Wi-Fi routers, allowing remote attackers to execute arbitrary code. The...

CVE-2023-22844: Use of Hard-coded Cryptographic Key

An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability...

PT-2023-5714

Name of the Vulnerable Software and Affected Versions Milesight VPN version 2.0.2 Description A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality. This vulnerability can be exploited by a specially-crafted network request, leading to authentication bypass. An...

Milesight UR32L urvpn_client Certificate Validation vulnerability

Talos Vulnerability Report TALOS-2023-1705 Milesight UR32L urvpnclient Certificate Validation vulnerability July 6, 2023 CVE Number CVE-2023-23546 SUMMARY A misconfiguration vulnerability exists in the urvpnclient functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle...

Milesight UR32L urvpn_client http_connection_readcb stack-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1718 Milesight UR32L urvpnclient httpconnectionreadcb stack-based buffer overflow vulnerability July 6, 2023 CVE Number CVE-2023-24019 SUMMARY A stack-based buffer overflow vulnerability exists in the urvpnclient httpconnectionreadcb functionality of Milesigh...

Alert: 330,000 FortiGate Firewalls Still Unpatched to CVE-2023-27997 RCE Flaw

No less than 330,000 FortiGate firewalls are still unpatched and vulnerable to CVE-2023-27997, a critical security flaw affecting Fortinet devices that has come under active exploitation in the wild. Cybersecurity firm Bishop Fox, in a report published last week, said that out of nearly 490,000...

Nord Security: Email verification bypass for manual connection setup using service credentials

Vulnerability description not provided...

JVN#64316789: Multiple vulnerabilities in SoftEther VPN and PacketiX VPN

SoftEther VPN provided by University of Tsukuba SoftEther VPN Project and PacketiX VPN provided by SoftEther Corporation contain multiple vulnerabilities listed below in VPN Client function, and Dynamic DNS Client function included in the VPN server. Heap-based buffer overflow CWE-122 -...

Error "Couldn't connect to server 'https://gwfqdn:non-443' when log on to non-443 port vpn vserver

You may get the following error message"Couldn't connect to server 'https://gwfqdn:non-443'; while attempting to log on to non-443 port NetScaler Gateway virtual server using the latest Windows Secure Access Client. :...

PT-2023-8738 · Softether · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEther VPN versions 4.41-9782-beta through 5.02 Description: A denial of service issue exists in the DCRegister functionality of SoftEther VPN, related to the DDNS RPC MAX RECV SIZE. This can be triggered by a specially crafted network...

Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series Weak Password Requirements (CVE-2023-2060)

Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or passwo...

FreeBSD : SoftEtherVPN -- multiple vulnerabilities (d821956f-1753-11ee-ad66-1c61b4739ac9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d821956f-1753-11ee-ad66-1c61b4739ac9 advisory. - Daiyuu Nobori reports: The SoftEther VPN project received a high level code review and...

SoftEtherVPN -- multiple vulnerabilities

Daiyuu Nobori reports: The SoftEther VPN project received a high level code review and technical assistance from Cisco Systems, Inc. of the United States from April to June 2023 to fix several vulnerabilities in the SoftEther VPN code. The risk of exploitation of any of the fixed vulnerabilities ...

ZyXEL USG FLEX Account Operator CGI Configuration Alteration DoS

The vulnerability of the accountoperator.cgi file in the ZyXEL USG FLEX and VPN networking devices relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow a malicious actor to remotely alter the device’s...

Mitsubishi Electric MELSEC-F Series

1. EXECUTIVE SUMMARY ​CVSS v3 7.5 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Mitsubishi Electric ​Equipment: MELSEC-F Series ​Vulnerability: Authentication Bypass by Capture-replay 2. RISK EVALUATION ​Successful exploitation of this vulnerability could allow an attacker to...