VPN-1 UTM Edge cross-site request forgery vulnerability (CVE-2007-3489)

...

F5 FirePass 4100 SSL VPN My.Activiation.PHP3远程命令注入漏洞

F5's FirePass SSL VPN提供使用标准WEB浏览器对应用程序和数据进行安全访问的解决方案。 F5 FirePass 4100不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'my.activation.php3'脚本对用户提交的'username'参数缺少过滤，在部分条件下允许用户注入Linux SHELL命令，导致以WEB权限执行。 F5 FirePass 4100 厂商解决方案 可参考如下安全公告获得补丁信息： https://tech.f5.com/home/solutions/sol167.html...

Design/Logic Flaw

my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter...

CVE-2007-3097

my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter...

CVE-2007-3097

FirePass (4100 SSL VPN) my.activation.php3 login page suffers a cross-site scripting (XSS) vulnerability due to insufficient sanitization of URL arguments, enabling attacker-controlled HTML/JavaScript when a user follows a crafted link. F5 advisory SOL6919 states this was fixed in maintenance ver...

S21Sec-035: F5 FirePass command execution vulnerability

S21Sec Advisory - Title: F5 FirePass command execution vulnerability ID: S21SEC-035-en Severity: High - Intrusion History: 14.Feb.2007 Vulnerability discovered 22.Feb.2007 Vendor contacted Scope: Linux's shell Command Execution Platforms: Linux based Appliance Author: Leonardo Nve [email protected]...

F5 Firepass SSL VPN unfiltered shell characters security vulnerabilities

Shell characters problem via username parameter of my.activation.php3 script...

Apple Mac OSX 10.4.9 - VPND Local Format String

Apple Mac OSX 10.4.9 - VPND Local Format String source: https://www.securityfocus.com/bid/24208/info Apple Mac OS X's VPN service daemon is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a...

Mac OS X Multiple Vulnerabilities (Security Update 2007-005)

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2007-005 applied. This update fixes security flaws in the following applications : Alias Manager BIND CoreGraphics crontabs fetchmail file iChat mDNSResponder PPP ruby screen texinfo VPN C Tenable...

Format string

Format string vulnerability in the VPN daemon vpnd in Apple Mac OS X 10.3.9 and 10.4.9 allows local users to execute arbitrary code via the -i parameter...

CVE-2007-0753

Format string vulnerability in the VPN daemon vpnd in Apple Mac OS X 10.3.9 and 10.4.9 allows local users to execute arbitrary code via the -i parameter...

CVE-2007-0753

Format string vulnerability in the VPN daemon vpnd in Apple Mac OS X 10.3.9 and 10.4.9 allows local users to execute arbitrary code via the -i parameter...

CVE-2007-0753

CVE-2007-0753 affects Apple Mac OS X VPND (VPN daemon) on affected platforms (OS X Server 10.4.9 and earlier; 10.3.9 referenced). The vulnerability is a local format-string flaw in vpnd triggered by the -i parameter, where untrusted input is passed into a format function, and vpnd runs with setui...

SOL6999 - Web browser domain-based security and discussion of "double eval()" and FP_DO_NOT_TOUCH tags - VU#261869

This potential vulnerability is discussed in the Web browser domain-based security section of this advisory. Additionally, the January 2007 security advisory 1 discusses a potential FirePass cross-site scripting vulnerability related to the double eval Javascript and FPDONOTTOUCH tags. This...

Cisco PIX/ASA设备多个远程拒绝服务及认证绕过漏洞

PIX是一款防火墙设备，可为用户和应用提供策略强化、多载体攻击防护和安全连接服务；自适应安全设备（ASA）是可提供安全和VPN服务的模块化平台。 Cisco PIX/ASA设备中存在多个远程漏洞，远程攻击者可能利用此漏洞导致设备无法正常工作或绕过认证。 具体如下： 绕过LDAP认证 +------------------------- 使用LDAP AAA服务器对终止的L2TP IPSec隧道或远程管理会话进行认证的Cisco ASA 和PIX设备可能受认证绕过攻击的影响，更多信息请见以下公告： 2层隧道协议（L2TP） 必须将终止L2TP...

Cisco Security Advisory: LDAP and VPN Vulnerabilities in PIX and ASA Appliances

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: LDAP and VPN Vulnerabilities in PIX and ASA Appliances Advisory ID: cisco-sa-20070502-asa http://www.cisco.com/warp/public/707/cisco-sa-20070502-asa.shtml Revision 1.0 Last Updated 2007 May 02 1600 UTC GMT For Public Release...

Cisco PIX / Adaptive Security Appliance firewalls multipls security vulnerabilities

LDAP authentication bypass. VPN connection and LDAP multiple denial of service...

Cisco ASA clientless SSL VPN denial of service vulnerability

Overview The Cisco ASA firewall's SSL VPN component contains an denial-of-service vulnerability. Description The Cisco Adaptive Security Appliance ASA is firewall that includes routing, intrusion prevention system IPS, and VPN components. The clientless SSL VPN allows remote users with a web...

Design/Logic Flaw

Unspecified vulnerability in Cisco Adaptive Security Appliance ASA and PIX 7.1 before 7.1249 and 7.2 before 7.2217 allows remote attackers to cause a denial of service device reload via unknown vectors related to VPN connection termination and password expiry...

CVE-2007-2463

Unspecified vulnerability in Cisco Adaptive Security Appliance ASA and PIX 7.1 before 7.1249 and 7.2 before 7.2217 allows remote attackers to cause a denial of service device reload via unknown vectors related to VPN connection termination and password expiry...