Critical RCE Bug in Cisco WebEx Browser Extensions Faces 'Ongoing Exploitation'

A critical vulnerability in Cisco WebEx browser extensions that could allow unauthenticated remote code-execution RCE on targeted machines is being actively exploited in the wild. The news comes just days after Cisco issued a flurry of 24 different patches for its IOS XE operating system and warn...

CVE-2019-17388

Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications. Recent assessments: kevthehermit at March 05, 2020 9:34am UTC reported: V...

ENTTEC Lighting Controllers

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ENTTEC Equipment: Datagate MK2, Storm 24, Pixelator Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could reboot this...

Check Point Response to CVE-2019-8456 - unauthorized VPN access to internal networks via IKEv2 tunnel

Symptoms - In some less common conditions, Check Point IKEv2 IPsec VPN up to R80.30 may allow an attacker with knowledge of the internal configuration and setup to successfully connect to a site-to-site VPN server. Solution Important Notes: R77.x versions are not affected because they use a...

Cisco RV130W Routers Management Interface Remote Command Execution

A vulnerability in the web-based management interface of the Cisco RV130W Wireless-N Multifunction VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based...

Get 4 Essential CyberSecurity Software For Less Than $10 Per Month

Major data breaches and cyber attacks are occurring at an alarming rate, and if you are still not using a VPN and password manager app, you are seriously out of excuses. Not just VPN software and a password manager, cybersecurity experts also recommend using antivirus and backup solutions to...

CVE-2019-6724

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root...

Design/Logic Flaw

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root...

AVEVA InduSoft Web Studio and InTouch Edge HMI

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Low skill level to exploit Vendor: AVEVA Equipment: InduSoft Web Studio, InTouch Edge HMI Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow execution of unauthorized code or...

CVE-2019-6724

CVE-2019-6724 concerns the Barracuda VPN Client. The vulnerable component is the barracudavpn component in version prior to 5.0.2.7 for Linux, macOS, and OpenBSD, which runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary co...

CVE-2019-6724

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root...

CVE-2018-20812

An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel when Traffic Enforcement was enabled exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack IPv4/IPv6 endpoints...

CVE-2018-20812

CVE-2018-20812 describes an information exposure in Pulse Secure Desktop where IPv6 DNS traffic could escape the VPN tunnel when Traffic Enforcement is enabled, affecting dual‑stack (IPv4/IPv6) endpoints. Affected: Pulse Secure Desktop 9.0R1 and earlier. Impact: potential disclosure of sensitive ...

The vulnerability of the command-line tool astra-openvpn-server for configuring OpenVPN servers on the Astra Linux operating system stems from a configuration parameter interpretation error in the client software. This flaw allows an attacker to cause a service failure.

The vulnerability of the command-line tool astra-openvpn-server for configuring OpenVPN servers on the Astra Linux operating system is related to an interpretation error in the configuration parameters set for clients. Exploiting this vulnerability allows a malicious actor to cause service failur...

Prevent Access to Unauthorized Viewers with Enhanced Proxy Detection

Background: Geo-Blocking Content There are no hard and fast rules to the way content is licensed throughout the world, but typically content owners develop license agreements at the country level which gives them a fair amount of flexibility when monetizing their content. These license agreements...

This Week in Security News: Instagram Hackers and Enterprise Threats

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn how a group of hackers is stealing popular Instagram profiles. Also, learn about old and new cybersecurity issues inundated enterprise...

Insecure VPNs: Top risks and symptoms that stronger security is needed

Virtual private networks, or VPNs, were created to provide a secure tunnel in which user activity can be carried out in privacy. In this way, VPNs have been utilized by individual users, as well as to support business processes for several years, and their use is only growing. According to curren...

Cisco Fixes Critical Flaw in Wireless VPN, Firewall Routers

Cisco is urging customers to update their wireless VPN and firewall routers, after patching a critical vulnerability that could allow unauthenticated, remote attackers to execute arbitrary code. The vulnerability, CVE-2019-1663, has a CVSS score of 9.8 and impacts the Cisco RV110W Wireless-N VPN...

Check your VPN DNS test tool legitimacy: Is it “good” or deceptive

By Zehra Ali Does your VPN leaks DNS data? Does the DNS testing tool you're using shows real results or shows sponsored results for affiliate marketing? Virtual private network VPN users are increasing at a great pace due to growing privacy concerns and numerous VPN options, including both, the...

The vulnerability of the Junos OS, related to errors in the token caching mechanisms of dynamic VPN connections, allows a hacker to gain access to the device.

The vulnerability of the Junos OS is related to errors in the token caching mechanisms of dynamic VPN connections. Exploiting this vulnerability can allow an attacker to remotely gain access to the device...