The vulnerability of the software for accessing the VPN service vpn-user-portal arises due to insufficient validation of input data. This allows a hacker to increase their privileges.

The vulnerability of the software for accessing the VPN service vpn-user-portal exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the VPN gateway web interface for corporate networks, Pulse Connect Secure, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the VPN gateway web interface for corporate networks in Pulse Connect Secure is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

October 19, 2021—KB5006744 (OS Build 17763.2268) Preview

None None...

CVE-2021-41583

vpn-user-portal aka eduVPN or Let's Connect! before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional V...

Openvpn OpenVPN 跨站请求伪造漏洞

Openvpn OpenVPN is a software package from the US company OpenVPN Openvpn for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using a public key, an e-certificate, or ...

CVE-2021-20037

SonicWall Global VPN Client 4.10.5 installer 32-bit and 64-bit incorrect default file permission vulnerability leads to privilege escalation which potentially allows command execution in the host operating system. This vulnerability impacts GVC 4.10.5 installer and earlier...

Server-Side Request Forgery (SSRF) in osticket/osticket

Description The SSRF vulnerability in OSTickets detailed in CVE-2020-24881 is still unfixed, attackers can still make arbitrary requests via the server to the private network via the PDF print generator although they will not be able to exfiltrate anything other than image data. Proof of Concept ...

CVE-2020-8561

A flaw was found in Kubernetes. This flaw allows an actor that controls the responses of the MutatingWebhookConfiguration or the ValidatingWebhookConfiguration requests to redirect kube-apiserver requests to the private network of the apiserver. If that user can view kube-apiserver logs when the...

CVE-2021-37190

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. The affected software has an information disclosure vulnerability that could allow an attacker to retrieve VPN connection for a known user...

Server side request forgery (ssrf)

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

Apple iOS 安全漏洞

Apple iOS is a set of operating systems developed for mobile devices by the American company Apple. Apple iOS 15 and iPadOS 15 previously had a security vulnerability that stemmed from the fact that VPN configurations may have been installed by apps without the user's permission...

PT-2021-7544 · Phoenix Contact +2 · Fl Mguard Dm +2

Name of the Vulnerable Software and Affected Versions: Phoenix Contact: FL MGUARD DM versions 1.12.0 through 1.13.0 Description: The issue is related to inadequate access control in the Apache web server installed as part of the FL MGUARD DM on Microsoft Windows. Attackers with network access to...

Mitsubishi Electric MELSEC iQ-R Series

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Corporation Equipment : MELSEC iQ-R Series CPU Module Vulnerability : Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this...

Vulnerabilities fixed in ForsiOS

FortiGuard Labs has fixed several vulnerabilities in FortiOS. The vulnerabilities allow a malicious party to execute attacks that potentially lead to the execution of arbitrary code under the user's privileges. FortiGuard Labs has released updates to fix the vulnerabilities fixes in FortiOS SSL...

Cisco Small Business 操作系统命令注入漏洞

The Cisco Small Business RV160 and RV260 are is a router. A remote command execution vulnerability exists in the Cisco Small Business RV160 and RV260 series VPN routers. An attacker could exploit the vulnerability to execute arbitrary commands on an affected device...

CVE-2021-33526

In MB connect line mbDIALUP versions = 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service...

July 29, 2021—KB5004293 (OS Build 18363.1714) Preview

None None...

The vulnerability of the software for creating a private virtual network, astra-openvpn-server, related to integer overflows, allows a hacker to cause a service failure.

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to improperly defined variable boundaries. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the software for creating a private virtual network, astra-openvpn-server, related to code errors, allows a intruder to trigger a service failure.

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to a code error that prevents the /etc/openvpn/keys/ directory from being created. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

CVE-2021-0505

In the Settings app, there is a possible way to disable an always-on VPN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android...