Network Vision IntraVue Code Injection Vulnerability

OVERVIEW Researcher Jürgen Bilberger from Daimler TSS GmbH has identified a code injection vulnerability in Network Vision’s IntraVue software. Network Vision has produced a new version that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The...

Critical 'Port Fail' Vulnerability Reveals Real IP Addresses of VPN Users

A newly discovered flaw affecting all VPN protocols and operating systems has the capability to reveal the real IP-addresses of users' computers, including BitTorrent users, with relative ease. The vulnerability, dubbed Port Fail by VPN provider Perfect Privacy PP who discovered the issue, is a...

Huawei路由器VPN路由转发跳跃漏洞

No description provided by source...

Imgur: Imgur dev environments facing the Internet

A security group configuration error allowed Imgur development environments to face the public internet. Typically these environments were protected behind a special endpoint which would open access to authenticated Imgur employees for a short time window. Since the development environments were...

CVE-2015-8087

Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and...

Design/Logic Flaw

Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and...

CVE-2015-8087

Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and...

StrongSwan Security Mechanism Bypass Vulnerability

strongSwan is an open source IPsec-based VPN solution for Linux. The server implementation of the EAP-MSCHAPv2 protocol in strongSwan's eap-mschapv2 plugin fails to properly validate the local state, allowing a remote attacker to bypass authentication by sending an empty Success message in respon...

USN-2811-1: strongSwan vulnerability

It was discovered that the strongSwan eap-mschapv2 plugin incorrectly handled state. A remote attacker could use this issue to bypass authentication...

Debian Security Advisory DSA 3398-1 (strongswan - security update)

Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without...

ownCloud: RCE in ci.owncloud.com / ci.owncloud.org

Hi, I know you are more interested in vulnerabilities found in ownCloud Server, but I do would like to inform you on a RCE that can be executed on ci.owncloud.com/org. Vulnerability There is a 0day vulnerability in Jenkins that can be exploited in certain circumstances. The Jenkins instance on...

Fewer IPsec VPN Connections at Risk to Weak Diffie-Hellman

A challenge has been made against one of the conclusions in a potentially blockbuster academic paper on cryptographic weaknesses that may be the open door through which intelligence agencies are breaking encrypted connections. The paper, “Imperfect Forward Secrecy: How Diffie-Hellman Fails in...

Privatoria — Best VPN Service for Fast, Anonymous and Secure Browsing

PRIVACY – a bit of an Internet buzzword nowadays. Why? Because the business model of the Internet has now become data collection. If you trust Google, Facebook or other Internet giants to be responsible managers of your data, the ongoing Edward Snowden revelations are making it all clear that thi...

Cisco ASA Software VPN ISAKMP Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange IKE version 1 v1 code of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause an affected system to reload. The vulnerability is due to improper handling of Internet Security Association and Key...

Cisco ASR 5000 and 5500 Device TACACS Packet Denial of Service Vulnerability

The Cisco ASR 5000 and 5500 devices are Cisco's 5000 series of wireless controller products. A security vulnerability exists in the Cisco ASR 5000 and 5500 device. It allows a remote attacker to submit a special TACACS packet header to restart the vpnmgr process...

How NSA successfully Broke Trillions of Encrypted Connections

Yes, it seems like the mystery has been solved. We are aware of the United States National Security Agency NSA powers to break almost unbreakable encryption used on the Internet and intercept nearly Trillions of Internet connections – thanks to the revelations made by whistleblower Edward Snowden...

Cisco VPN Client Elevation of Privilege Vulnerability

Cisco VPN Client is a cross-platform client software suite. Cisco VPN Client fails to properly assign permissions to the vpnclient.ini file, which can be elevated by a local attacker by entering an arbitrary process name into the 'Command' field of the ApplicationLauncher...

Hackers Backdooring Cisco WebVPN To Steal Customers’ Passwords

Virtual Private Networks VPNs, which is widely used by many businesses and organisations to provide secure access to their workers, are being abused to pilfer corporate user credentials. Researchers from security firm Volexity discovered a new attack campaign that targets a widely used VPN produc...

CVE-2015-7600

Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section...

Design/Logic Flaw

Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section...