CVE-2020-11711

An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...

CVE-2021-27932: Undefined Security Weakness

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

PT-2023-11453 · Stormshield · Stormshield Sns

Name of the Vulnerable Software and Affected Versions: Stormshield SNS version 3.8.0 Description: An issue was discovered in the admin login panel, allowing authenticated Stored XSS, which can lead to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel and...

CVE-2020-11711: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...

CVE-2021-27932

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

CVE-2021-27932

Stormshield Network Security (SNS) VPN SSL Client versions 2.1.0–2.8.0 are affected by insecure permissions (CVE-2021-27932). Root cause: insecure permissions as described in the CVE entry. Impact (per CVSS v3.1 in the entry): high confidentiality, integrity, and availability with a base score of...

CVE-2021-27932

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

Stormshield Network Security (SNS) VPN SSL Client 安全漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability exists in the Stormshield Network Security SNS VPN SSL Client versions 2.1.0 through 2.8.0 that stems from having insecure privileges...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

Design/Logic Flaw

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

Stormshield SSL VPN Client Security Vulnerability

Stormshield SSL VPN Client is a VPN client from Stormshield. A security vulnerability exists in Stormshield SSL VPN Client versions prior to 3.2.0, which originated from a vulnerability that allows logged-in users to execute malicious code as an administrator on a local computer using OpenVPN...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

PT-2023-15027 · Stormshield · Stormshield Ssl Vpn Client

Name of the Vulnerable Software and Affected Versions: Stormshield SSL VPN Client versions prior to 3.2.0 Description: A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine. Recommendations: For versio...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

CVE-2022-46782

The vulnerability CVE-2022-46782 affects Stormshield SSL VPN Client prior to 3.2.0. A logged-in user who can launch the VPNSSL Client can cause the bundled OpenVPN instance to execute code with administrator privileges on the local machine, enabling a local impact (high). Root cause is improper h...

CVE-2022-46782: Undefined Security Weakness

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

CVE-2023-35799

Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges...

CVE-2023-35800

Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators...