CVE-2021-44466: Incorrect Permission Assignment for Critical Resource

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN...

PT-2021-24112

Name of the Vulnerable Software and Affected Versions: Bitmask Riseup VPN version 0.21.6 Description: The issue is related to improper access controls in the software. When installed in a non-default directory off the system root, the installer fails to properly set Access Control Lists ACLs. Thi...

ROS-2-816

2.816 OpenVPN Authentication Bypass CVE-2020-15078 1. Vulnerability Description: The vulnerability allows a remote attacker to bypass authentication and access restrictions to leak VPN configuration data. The issue only occurs on servers that are configured to use deferredauth. Under certain...

Vpn Plugin replacing destination IP with 0.0.0.0 for the 172.16.0.0/16 subnet - Spoofed IP to original IP.

ADC - While using VPN Plugin to access intranet resources, addresses for the subnet 172.16.0.0/16 are replaced by spoofed IP with a message similar to this: "Replaced the spoofed ip 172.16.10.10to original IP 0.0.0.0 in ICMP packet" And the traffic never reaches the destination...

How to Prevent Customer Support Help Desk Fraud Using VPN and Other Tools

It's no secret that the internet isn't a very safe place. And it's not hard to understand why. It's a medium that connects billions of people around the world that affords bad actors enough anonymity to wreak havoc without getting caught. It's almost as if the internet's tailor-made to enable sca...

‘PseudoManuscrypt’ Mass Spyware Campaign Targets 35K Systems

Researchers have tracked new spyware – dubbed “PseudoManuscrypt” because it’s similar to “Manuscrypt” malware from the Lazarus advanced persistent threat APT group – that’s attempted to scribble itself across more than 35,000 targeted computers in 195 countries. Kaspersky researchers said in a...

Wibu-Systems CodeMeter Runtime

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low attack complexity Vendor: Wibu-Systems AG Equipment: CodeMeter Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server, which could...

CVE-2021-27856

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002...

CVE-2021-27855

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this...

CVE-2021-0649

In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROLALWAYSONVPN with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-0649

In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROLALWAYSONVPN with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Design/Logic Flaw

In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROLALWAYSONVPN with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-0649

CVE-2021-0649 affects Android 11: In Vpn.java’s stopVpnProfile, there is a permissions bypass leading to a possible VPN profile reset and local elevation of privilege (CONTROL_ALWAYS_ON_VPN) with no user interaction. The issue is classified as a local elevation of privilege; patches are reference...

CVE-2021-0649

In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROLALWAYSONVPN with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

FatPipe security vulnerabilities

FatPipe is a WAN redundancy technology from FatPipe USA that provides companies with automated and dynamic failover as a result of a WAN component or service failure resulting in a data line connection outage.A security vulnerability exists in FatPipe WARP, IPVPN and MPVPN, which stems from a lac...

Fortinet FortiProxy SSL VPN Cross-Site Request Forgery Vulnerability

Fortinet FortiProxy SSL VPN is an application from Fortinet, Inc. provides an intrusion detection feature.Fortinet FortiProxy SSL VPN suffers from a cross-site request forgery vulnerability that can be exploited by unauthenticated attackers to conduct cross-site request forgery CSRF attacks...

FatPipe security vulnerabilities

FatPipe is a WAN redundancy technology from FatPipe USA that provides companies with automated and dynamic failover due to the failure of a WAN component or service resulting in the loss of data line connectivity.A security vulnerability exists in FatPipe WARP, IPVPN and MPVPN, which stems from t...

Russia Blocks Tor Privacy Service in Latest Censorship Move

Russia has stepped up its censorship efforts in the country by fully blocking access to the Tor web anonymity service, coinciding with the ban of six virtual private network VPN operators, as the government continues its efforts to control the internet and crack down on attempts to circumvent...

SMA 100 flaws in SonicWall VPN expose devices to remote takeover

By Waqas If exploited, an unauthenticated, remote attacker can execute code as a "nobody user" in the device meaning attacker would get root access and gain full control of the device. This is a post from HackRead.com Read the original post: SMA 100 flaws in SonicWall VPN expose devices to remote...

CVE-2021-20145

Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the LAN interfaces of other users' devices connected to the same service. An attacker could leverage this to make configuration changes to, o...