10182 matches found
Palo Alto Networks PAN-OS 8.1.x < 8.1.17 / 9.0.x < 9.0.11 / 9.1.x < 9.1.5 / 10.0.x < 10.0.1 Authentication Bypass Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.17 or 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.5 or 10.0.x prior to 10.0.1. It is, therefore, affected by a vulnerability. - An authentication bypass vulnerability exists in the GlobalProtect SSL VPN...
Uncovered: APT 'Hackers For Hire' Target Financial, Entertainment Firms
A hackers-for-hire operation has been discovered using a strain of previously undocumented malware to target South Asian financial institutions and global entertainment companies. Dubbed "CostaRicto" by Blackberry researchers, the campaign appears to be the handiwork of APT mercenaries who posses...
CVE-2020-2050
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to...
Authentication flaw
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to...
CVE-2020-2050 PAN-OS: Authentication bypass vulnerability in GlobalProtect SSL VPN client certificate verification
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to...
CVE-2020-2050
This CVE concerns Palo Alto Networks PAN-OS GlobalProtect SSL VPN authentication bypass. The GlobalProtect SSL VPN component permits bypassing all client certificate checks with an invalid certificate, enabling a remote attacker to authenticate as any user and access restricted VPN resources when...
JVN#44764844: MELSEC iQ-R Series CPU Modules vulnerable to uncontrolled resource consumption
MELSEC iQ-R series CPU modules provided by Mitsubishi Electric Corporation contain an uncontrolled resource consumption vulnerability CWE-400. According to the developer, in case of "To Use or Not to Use Web Server Settings" in the parameter of CPU modules are set to "Not Use", this issue does no...
CVE-2020-2050: Improper Authorization
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to...
Empowering employees to securely work from anywhere with an internet-first model and Zero Trust
Like many this year, our Microsoft workforce had to quickly transition to a work from the home model in response to COVID-19. While nobody could have predicted the world’s current state, it has provided a very real-world test of the investments we have made implementing a Zero Trust security mode...
PAN-OS: Authentication bypass vulnerability in GlobalProtect client certificate verification
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to...
Targeted ransomware: it’s not just about encrypting your data!
When we talk about ransomware, we need to draw a line between what it used to be and what it currently is. Why? Because nowadays ransomware is not just about encrypting data – its primarily about data exfiltration. After that, its about data encryption and leaving convincing proof that the attack...
PT-2020-5818
Name of the Vulnerable Software and Affected Versions: PAN-OS versions prior to 8.1.17 PAN-OS versions prior to 9.0.11 PAN-OS versions prior to 9.1.5 PAN-OS versions prior to 10.0.1 Description: An authentication bypass issue exists in the GlobalProtect SSL VPN component of Palo Alto Networks...
Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliance Security Update
Description of Problem Multiple vulnerabilities have been discovered in Citrix ADC formerly known as NetScaler ADC, Citrix Gateway formerly known as NetScaler Gateway and Citrix SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could result...
Palo Alto Networks PAN-OS VPN Enabled Detection
Binary data paloaltovpnenableddetect.nbin...
libreswan bug fix and enhancement update
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network VPN...
OAuth session fixation vulnerability in Mozilla VPN — Mozilla
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP...
Synology QuickConnect servers network misconfiguration vulnerability
Summary An exploitable network misconfiguration vulnerability exists in the VPN servers of Synology QuickConnect. The server does not enforce proper subnetting, allowing an attacker to reach any device connected to the VPN. To abuse this vulnerability, the attacker needs to change their subnet...
Synology SRM QuickConnect authentication Information Disclosure Vulnerability
Talos Vulnerability Report TALOS-2020-1058 Synology SRM QuickConnect authentication Information Disclosure Vulnerability October 29, 2020 CVE Number CVE-2020-27649 SUMMARY An exploitable information disclosure vulnerability exists in the QuickConnect authentication functionality of Synology SRM...
Synology SRM QuickConnect HTTP connection Information Disclosure Vulnerability
Talos Vulnerability Report TALOS-2020-1061 Synology SRM QuickConnect HTTP connection Information Disclosure Vulnerability October 29, 2020 CVE Number CVE-2020-27653 SUMMARY An exploitable information disclosure vulnerability exists in the QuickConnect HTTP connection functionality of Synology SRM...
