CVE-2020-3483 Duo Network Gateway (DNG) Information Disclosure Vulnerability

Duo has identified and fixed an issue with the Duo Network Gateway DNG product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG...

CVE-2020-3483 Duo Network Gateway (DNG) Information Disclosure Vulnerability

Duo has identified and fixed an issue with the Duo Network Gateway DNG product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG...

CVE-2020-3483

CVE-2020-3483 affects Duo Network Gateway (DNG). Root cause: certificate and private key values uploaded for DNG-protected applications were logged in plain-text due to incomplete exclusion in the logging logic. Affected versions: 1.3.3 through 1.5.7. Impact: if attackers gained access to DNG log...

PT-2020-17251

Name of the Vulnerable Software and Affected Versions Duo Network Gateway DNG versions 1.3.3 through 1.5.7 Description The issue concerns the logging of customer-provided SSL certificates and private keys in plain-text to local files on the DNG host. This could allow an attacker with access to th...

CVE-2020-3483: Plaintext Storage of a Password

Duo has identified and fixed an issue with the Duo Network Gateway DNG product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG...

Cisco DuoConnect Authentication Vulnerability

Cisco DuoConnect is a two-factor authentication solution from Cisco USA. A security vulnerability exists in Cisco DuoConnect versions prior to 1.1.1, which stems from the fact that when DuoConnect is configured as 'http://', under certain circumstances, the program sends authentication tokens ove...

CVE-2020-1633 Junos OS: MX Series: Crafted packets traversing a Broadband Network Gateway (BNG) configured with IPv6 NDP proxy could lead to Denial of Service

Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway BNG and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate traffic to be discarded,...

PT-2020-4139

Name of the Vulnerable Software and Affected Versions: Junos OS versions 17.4 through 19.2R2 Description: A crafted NDPv6 packet could transit a Junos device configured as a Broadband Network Gateway BNG and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate...

CVE-2020-1875

NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerability. The software system access an invalid pointer when an abnormal condition occurs in certain operation. Successful exploit could cause certain proce...

CVE-2019-16298

An issue was discovered in Open Network Operating System ONOS 1.14. In the virtual broadband network gateway application org.onosproject.virtualbng, the host event listener does not handle the following event types: HOSTMOVED, HOSTREMOVED, HOSTUPDATED. In combination with other applications, this...

Design/Logic Flaw

An issue was discovered in Open Network Operating System ONOS 1.14. In the virtual broadband network gateway application org.onosproject.virtualbng, the host event listener does not handle the following event types: HOSTMOVED, HOSTREMOVED, HOSTUPDATED. In combination with other applications, this...

CVE-2019-16298

An issue was discovered in Open Network Operating System ONOS 1.14. In the virtual broadband network gateway application org.onosproject.virtualbng, the host event listener does not handle the following event types: HOSTMOVED, HOSTREMOVED, HOSTUPDATED. In combination with other applications, this...

CVE-2019-16298

ONOS 1.14 contains a bug in the Virtual BNG app’s host event listener (org.onosproject.virtualbng) where HOST_MOVED, HOST_REMOVED, and HOST_UPDATED events are not handled. In combination with other applications, this could lead to the absence of intended code execution. The vulnerability is docum...

PT-2020-9811

Name of the Vulnerable Software and Affected Versions Open Network Operating System ONOS version 1.14 Description An issue was discovered in the virtual broadband network gateway application, specifically in the host event listener, which does not handle certain event types, including HOST MOVED,...

Authentication flaw

Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

CVE-2018-7340

Duo Network Gateway (DNG) 1.2.9 and earlier is affected by CVE-2018-7340 due to incorrect handling of XML DOM traversal and canonicalization in the python-saml library, which can allow an attacker to modify SAML data without invalidating the signature and potentially bypass authentication to SAML...

PT-2019-11094

Name of the Vulnerable Software and Affected Versions: Duo Network Gateway versions 1.2.9 and earlier Description: The issue may allow an attacker to manipulate SAML data without invalidating its cryptographic signature, potentially bypassing authentication to SAML service providers. This is due ...

CVE-2018-7340: Improper Authentication

Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

CVE-2017-7933

In ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text, which may allow an attacker to gain unauthorized access...

CVE-2018-0256

A vulnerability in the peer-to-peer message processing functionality of Cisco Packet Data Network Gateway could allow an unauthenticated, remote attacker to cause the Session Manager SESSMGR process on an affected device to restart, resulting in a denial of service DoS condition. The vulnerabilit...