Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability

A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect client. This vulnerability is...

Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. This vulnerability is due to uncontrolled memory allocation. An attacker could exploit this vulnerability by copyin...

CVE-2021-1568

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. This vulnerability is due to uncontrolled memory allocation. An attacker could exploit this vulnerability by copyin...

VPNs and Trust

TorrentFreak surveyed nineteen VPN providers, asking them questions about their privacy practices: what data they keep, how they respond to court order, what country they are incorporated in, and so on. Most interesting to me is the home countries of these companies. Express VPN is incorporated i...

CVE-2021-1567: Time-of-check Time-of-use (TOCTOU) Race Condition

A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect client. This vulnerability is...

CVE-2021-1568: Memory Allocation with Excessive Size Value

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. This vulnerability is due to uncontrolled memory allocation. An attacker could exploit this vulnerability by copyin...

PT-2021-3320

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client for Windows affected versions not specified Description A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service Do...

Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability (cisco-sa-anyconnect-pos-dll-ff8j6dFv)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cisco-sa-anyconnect-pos-dll-ff8j6dFv advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

Experts Shed Light On Distinctive Tactics Used by Hades Ransomware

Cybersecurity researchers on Tuesday disclosed "distinctive" tactics, techniques, and procedures TTPs adopted by operators of Hades ransomware that set it apart from the rest of the pack, attributing it to a financially motivated threat group called GOLD WINTER. "In many ways, the GOLD WINTER...

June 15, 2021—KB5003703 (OS Build 17763.2028) Preview

June 15, 2021—KB5003703 OS Build 17763.2028 Preview Applies To Win 10 Ent LTSC 2019 Win 10 IoT Ent LTSC 2019 Windows 10 IoT Core LTSC Windows Server 2019 Note NEW 6/15/21 IMPORTANT This release includes the Flash Removal Package. Taking this update will remove Adobe Flash from the machine. For mo...

June 15, 2021—KB5003698 (OS Build 18363.1645) Preview

June 15, 2021—KB5003698 OS Build 18363.1645 Preview Applies To Windows 10 Enterprise, version 1909 Windows 10 Enterprise and Education, version 1909 Windows 10 IoT Enterprise, version 1909 Note NEW 6/15/21 IMPORTANT This release includes the Flash Removal Package. Taking this update will remove...

Cisco AnyConnect Process Interaction Channel Modification

The vulnerability of the process-interaction channel of the Cisco AnyConnect Secure Mobility Client cryptographic security device is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to modify VPN profile files by sending specially created IPC...

Aviatrix VPN Client Permission Assignment Code Execution

The vulnerability of the Aviatrix VPN Client relates to the improper assignment of permissions for files. Exploiting this vulnerability can allow a hacker to execute arbitrary code...

AVPNC_RP VPN-client Privilege Escalation

The vulnerability of the AVPNCRP VPN client from Aviatrix VPN is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges or execute arbitrary code...

FortiOS SSL-VPN Portal DoS

The vulnerability of the SSL-VPN portal for FortiOS operating systems is related to the execution of operations outside the buffer. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending a specially crafted POST request...

FortiOS SSL-VPN XSS

The vulnerability of the SSL-VPN portal for FortiOS operating systems exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

A week in security (June 7 – June 13)

Last week on Malwarebytes Labs: Amazon SIdewalk starts sharing your WiFi data tomorrow, thanks White hat, black hat, grey hat hackers: what’s the difference? Can two VPN “wrongs” make a right? Lock and Code S02E10 DOJ recovers pipeline ransom, signals more aggressive approach to cybercrime 800...

How to remove the File Transfer Tab in a Full VPN NetScaler Gateway

How to remove the "File Transfer" Tab to prevent users from downloading files when accessing the environment through the NetScaler Gateway...

Rockwell Automation FactoryTalk Services Platform

1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: FactoryTalk Services Platform Vulnerability: Protection Mechanism Failure 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote, authenticated users to bypass...

DarkSide Pwned Colonial With Old VPN Password

It took only one dusty, no-longer-used password for the DarkSide cybercriminals to breach the network of Colonial Pipeline Co. last month, resulting in a ransomware attack that caused significant disruption and remains under investigation by the U.S. government and cybersecurity experts. Attacker...