The vulnerability of the implementation of the Security Assertion Markup Language (SAML) in Cisco Adaptive Security Appliances and Cisco Firepower Threat Defense allows a perpetrator to bypass the authentication process.

The vulnerability of the Security Assertion Markup Language SAML implementation in Cisco Adaptive Security Appliances and Cisco Firepower Threat Defense is related to authentication errors when using NT LAN Manager NTLM or basic authentication. Exploiting this vulnerability allows a malicious act...

Heap overflow

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

Top 5 Last-Minute Memorial Day Deals at THN Store → Get 60% Extra OFF

Memorial Day has come and gone, but you still have time to land some of the best deals on some of the best apps and tech training bundles around. Whether you're looking for a world-class VPN or want to begin a career as a high-paid ethical hacker or IT pro, this list of ultra-discounted apps and...

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

CVE-2018-13383

CVE-2018-13383 describes a heap buffer overflow in Fortinet FortiOS and FortiProxy SSL VPN web portal. Affected products include FortiOS 6.0.0–6.0.4, 5.6.0–5.6.10, 5.4.0–5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier. The vulnerability arises from improper handling of Javascri...

SUSE SLED15 / SLES15 Security Update : NetworkManager (SUSE-SU-2019:1369-1)

This update for NetworkManager fixes the following issues : Following security issue was fixed : CVE-2018-1000135: A potential leak of private DNS queries to other DNS servers could happen while on VPN bsc1086263, bgo746422. Note that Tenable Network Security has extracted the preceding descripti...

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

SUSE-SU-2019:1369-1 Security update for NetworkManager

This update for NetworkManager fixes the following issues: Following security issue was fixed: - CVE-2018-1000135: A potential leak of private DNS queries to other DNS servers could happen while on VPN bsc1086263, bgo746422...

X (Formerly Twitter): Potential pre-auth RCE on Twitter VPN

Hi, weOrange Tsai and Meh Chang are the security research team from DEVCORE. Recently, we are doing a research about SSL VPN security, and found several critical vulnerabilities on Pulse Secure SSL VPN! We have reported to vendor and patches have been released on 2019/4/25. Since that, we keep...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability (macOS)

The version of Fortinet FortiClient Mac running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only ...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability

The version of Fortinet FortiClient running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if...

Protect

Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting XSS or an URL Redirection attack...

PT-2019-3002

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.0 through 6.0.4 FortiOS versions 5.6.3 through 5.6.7 FortiOS versions 5.4.6 through 5.4.12 FortiProxy version 2.0.0 FortiProxy versions 1.2.0 through 1.2.8 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.0.0...

Protect

A path traversal vulnerability in the FortiOS SSL VPN web portal may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests...

The vulnerability of the GlobalProtect Agent VPN application, related to authentication procedures that are insufficient, allows a hacker to forge a VPN session and gain access under the user’s identity.

The vulnerability of the corporate VPN application GlobalProtect Agent is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to forge a VPN session and gain access under the user’s identity...

The multiple vulnerabilities of the WebVPN microprogramming-based network interface device from Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense allow attackers to execute cross-site scripting attacks.

The multiple vulnerabilities of the WebVPN microprogramming device-based Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense exist due to the lack of measures taken to protect the website structure. Exploitation of these vulnerabilities could allow a malicious actor to perform...

OSIF - Open Source Information Facebook

OSIF is an accurate facebook account information gathering, all sensitive information can be easily gathered even though the target converts all of its privacy to only me, Sensitive information about residence, date of birth, occupation, phone number and email address. Installation $ pkg update...