Cloudflare Launches Its Security-Focused Mobile VPN, Again

When the company first launched the Warp VPN, “all hell broke loose,” its CEO says. After a few months of tinkering, Cloudflare wants a do-over...

The Benefits of Using a VPN at Home

By Uzair Amir To many people, the idea of using a VPN is still in its infancy while some believe that VPNs are for those who often use public Wi-Fi networks. This is a post from HackRead.com Read the original post: The Benefits of Using a VPN at Home...

CVE-2019-6145

Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach La...

Design/Logic Flaw

Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach La...

CVE-2019-6145

Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach La...

CVE-2019-6145

CVE-2019-6145 affects Forcepoint VPN Client for Windows versions before 6.6.1. The flaw is an unquoted search path that can be exploited locally to escalate privileges to NT AUTHORITY\SYSTEM. It relies on an attacker having local access with write permissions to two locations: C:\Program.exe and ...

Forcepoint VPN Client is Vulnerable to Privilege Escalation Attacks

A vulnerability has been discovered in the Forcepoint VPN Client software for Windows. The flaw could enable an attacker – with an existing foothold on a system – to achieve an escalation of privilege, persistence and in some cases defense evasion. The vulnerability CVE-2019-6145 stems from an...

[SECURITY] Fedora 29 Update: openconnect-8.05-1.fc29

This package provides a multiprotocol VPN client for Cisco AnyConnect, Juniper SSL VPN / Pulse Connect Secure, and Palo Alto Networks GlobalProtect SSL VPN...

[SECURITY] Fedora 30 Update: openconnect-8.05-1.fc30

This package provides a multiprotocol VPN client for Cisco AnyConnect, Juniper SSL VPN / Pulse Connect Secure, and Palo Alto Networks GlobalProtect SSL VPN...

Fedora Update for openconnect FEDORA-2019-1caffa01f2

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for openconnect FEDORA-2019-4c0d6e1784

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (█████████.mil)

The Cisco VPN vulnerability CVE-2018-0296 was discovered in an instance of https://████/ ██████.mil. The vulnerability allowed for path traversal, which could have been used to disclose sensitive information such as VPN sessions and files. The issue was addressed by updating to a patched version ...

U.S. Dept Of Defense: Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)

The Pulse Secure SSL VPN was found to be vulnerable to multiple issues, including pre-authentication arbitrary file reading CVE-2019-11510 and post-authentication command injection CVE-2019-11539. These vulnerabilities were discovered and disclosed by security researcher Orange Tsai. The...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (no hostname)

The Cisco VPN was vulnerable to a path traversal vulnerability CVE-2018-0296 that allowed an unauthenticated attacker to disclose sensitive information such as VPN sessions and user files...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (██████)

The Cisco VPN was found to be vulnerable to a path traversal vulnerability CVE-2018-0296. The vulnerability allowed an unauthenticated attacker to access sensitive information such as VPN sessions and files...

A week in security (September 9 – 15)

Last week on the Labs blog, we looked at free VPN offerings, how malware can hinder vital emergency services, and explored how the Heartbleed vulnerability is still causing problems. We also talked about a large FTC settlement involving Google, and how to keep an eye out for leaky AWS buckets...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (████.███.mil)

The CVE-2018-0296 vulnerability was discovered in a Cisco VPN system. It allowed an unauthenticated attacker to perform path traversal and disclose sensitive information such as VPN sessions and user files. The issue was addressed by updating to a patched version that returned a 404 "File not...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███ (████████████████)

A path traversal vulnerability was discovered in Cisco VPN that could allow unauthenticated users to disclose sensitive information such as VPN sessions and files. The vulnerability was assigned CVE-2018-0296. The vulnerability was fixed in updated versions of the software...

[SECURITY] Fedora 31 Update: openconnect-8.05-1.fc31

This package provides a multiprotocol VPN client for Cisco AnyConnect, Juniper SSL VPN / Pulse Connect Secure, and Palo Alto Networks GlobalProtect SSL VPN...

Pulse Connect Secure Cross-Site Scripting (CVE-2019-11507)

A cross-site scripting vulnerability exists in Pulse Secure SSL VPN. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary commands on the affected system...