Zyxel Firewall SUID Binary Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zyxel Firewall SUID Binary Privilege Escalation', 'Description' = %q This module exploits CVE-2022-30526, a local privilege escalation...

MAL-2022-7423 Malicious code in free-net-vpn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7c578ebbd5b9dea94fedafe257ab0b885731b9f32789b9d9a2708193ef03995 Security researchers at Check Point Research discovered a malicious package called free-net-vpn that targets environment variables. PyPI has since remove...

free-net-vpn malicious PyPI package

Security researchers at Check Point Research discovered a malicious package called free-net-vpn that targets environment variables. PyPI has since removed free-net-vpn...

Malicious code in free-net-vpn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7c578ebbd5b9dea94fedafe257ab0b885731b9f32789b9d9a2708193ef03995 Security researchers at Check Point Research discovered a malicious package called free-net-vpn that targets environment variables. PyPI has since remove...

Cisco ASA Clientless SSL VPN (WebVPN) Brute-force Login Utility

This module scans for Cisco ASA Clientless SSL VPN WebVPN web login portals and performs login brute-force to identify valid credentials. Module Options msf use auxiliary/scanner/http/ciscoasaclientlessvpn msf auxiliaryciscoasaclientlessvpn show actions ...actions... msf...

After upgrade to 13.0-85.x or above, unable to access Citrix VPN.

Users getting " No Intranet IP available " post authentication to Citrix VPN. This is only seen in ADC version 13.0-85.x and above...

ZTNA vs VPN: Secure Remote Work & Access - SASE Part 2

Explore the drivers behind switching from VPN to Zero Trust Network Access ZTNA for any device access from anywhere...

Thousands of Hikvision video cameras remain unpatched and vulnerable to takeover

In September 2021 we told you about insecure Hikvision security cameras that were ready to be taken over remotely. However, according to a whitepaper published by CYFIRMA, tens of thousands of systems used by 2,300 organizations across 100 countries have still not applied the security update, and...

Delta Industrial Automation DIALink

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: Delta Industrial Automation DIALink Vulnerability: Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of this vulnerability could result in the...

iOS Can Stop VPNs From Working as Expected—and Expose Your Data

A security researcher claims that Apple mobile devices keep connections open if they are created before a VPN is activated...

Yokogawa CENTUM Controller FCS

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Yokogawa Equipment: CENTUM VP & CS 3000 Controller FCS Vulnerability: Denial of Service 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the affected device, resulting in a...

CVE-2022-38368

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...

CVE-2022-38368

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...

Command injection

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...

OPENSUSE-SU-2022:10088-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to 89.0.4447.71 - CHR-8957 Update chromium on desktop-stable-103-4447 to 103.0.5060.134 - DNA-100492 authPrivate.storeCredentials should work with running auth session - DNA-100649 “Sign out” from settings doesn’t also sign out...

OPENSUSE-SU-2022:10087-1 Security update for opera

This update for opera fixes the following issues: opera was updated to 89.0.4447.71 - CHR-8957 Update chromium on desktop-stable-103-4447 to 103.0.5060.134 - DNA-100492 authPrivate.storeCredentials should work with running auth session - DNA-100649 “Sign out” from settings doesn’t also sign out...

CVE-2022-38368

Summary: CVE-2022-38368 affects Aviatrix Gateway. The issue arises because Gateway API functions mishandle authentication, enabling an authenticated VPN user to inject arbitrary commands. Affected versions: Aviatrix Gateway prior to 6.6.5712 and 6.7.x prior to 6.7.1376. Impact: Command injection ...

Aviatrix Gateway Authorization Issue Vulnerability

Aviatrix Gateway is a single common platform for multi-cloud networks from Aviatrix USA. A security vulnerability in Aviatrix Gateway versions prior to 6.6.5712 and 6.7.x prior to 6.7.1376 stems from an API function that improperly handles authentication, allowing an authenticated VPN user to...

PT-2022-24390 · Aviatrix · Aviatrix Gateway

Name of the Vulnerable Software and Affected Versions: Aviatrix Gateway versions prior to 6.6.5712 Aviatrix Gateway versions 6.7.x prior to 6.7.1376 Description: An issue was discovered in Aviatrix Gateway where Gateway API functions mishandle authentication. This allows an authenticated VPN user...

CVE-2022-38368: Improper Authentication

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...