37 matches found
Belsen_Group-et-exploitation-de-la-CVE-2022-40684
BelsenGroup と CVE-2022-40684 の悪用 背景 2025年1月29日、サイバー犯罪フォーラムBelsenGroupのユーザーが、設定ファイルやVPNパスワードを含む15,000台のFortinet機器を侵害したと主張するメッセージを投稿しました。現在、ダークウェブで1,000の独占的なターゲットを販売しています。 しかし、ファイルの分析によると、BelsenGroupがこの侵害の原因ではなく、HTTP/HTTPSを介した認証なしの管理者アクセスを可能にする重大な脆弱性CVE-2022-40684の悪用による以前の漏洩を単に再利用したことが示されています。...
EUVD-2026-80043
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in modvpnremote/plan.json, pptpdusershow.cgi, pptpclientconfigshow.cgi, and l2tpdusershow.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...
CVE-2026-76871
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in modvpnremote/plan.json, pptpdusershow.cgi, pptpclientconfigshow.cgi, and l2tpdusershow.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...
CVE-2026-76871
Netcore NR255-V router, version 1.5.130703 , is affected by a sensitive information disclosure vulnerability spanning four components: mod_vpn_remote/plan.json , pptpd_user_show.cgi , pptp_client_config_show.cgi , and l2tpd_user_show.cgi . An attacker with low privileges over the network can leve...
CVE-2026-4113
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials...
ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More
ThreatsDay Bulletin is back on The Hacker News, and this week feels off in a familiar way. Nothing loud, nothing breaking everything at once. Just a lot of small things that shouldn’t work anymore but still do. Some of it looks simple, almost sloppy, until you see how well it lands. Other bits fe...
CVE-2026-20049
A vulnerability in the processing of Galois/Counter Mode GCM-encrypted Internet Key Exchange version 2 IKEv2 IPsec traffic of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an authenticated, remote attacker to cause...
CVE-2026-20014
A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also impact the availability of services to devices...
PT-2025-47357
Name of the Vulnerable Software and Affected Versions Fortinet FortiClientWindows versions 7.0.0 through 7.4.3 Fortinet FortiClientWindows version 7.2.0 through 7.2.10 Description A debug code issue exists in FortiClientWindows that could allow a local attacker to execute the application step by...
EUVD-2020-5102
Malware in sbrugna...
EUVD-2022-25405
Malicious code in bioql PyPI...
EUVD-2023-31834
Malicious code in bioql PyPI...
EUVD-2025-9555
Malicious code in bioql PyPI...
CVE-2023-28123
A permission misconfiguration in UI Desktop for Windows Version 0.59.1.71 and earlier could allow an user to hijack VPN credentials while UID VPN is starting.This vulnerability is fixed in Version 0.62.3 and later...
CVE-2022-20145
In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote escalation of privilege if a malicious Wi-Fi AP is used, with no additional execution privileges needed. User interaction is not needed for...
CVE-2025-20192
A vulnerability in the Internet Key Exchange version 1 IKEv1 implementation of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The attacker must have valid IKEv1 VPN credentials to exploit this vulnerability. This vulnerability is du...
EncryptHub Deploys Ransomware and Stealer via Trojanized Apps, PPI Services, and Phishing
The financially motivated threat actor known as EncryptHub has been observed orchestrating sophisticated phishing campaigns to deploy information stealers and ransomware, while also working on a new product called EncryptRAT. "EncryptHub has been observed targeting users of popular applications, ...
Warning: DEEPDATA Malware Exploiting Unpatched Fortinet Flaw to Steal VPN Credentials
A threat actor known as BrazenBamboo has exploited an unresolved security flaw in Fortinet's FortiClient for Windows to extract VPN credentials as part of a modular framework called DEEPDATA. Volexity, which disclosed the findings Friday, said it identified the zero-day exploitation of the...
Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware
Threat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware. Cybersecurity vendor Sophos said it has been tracking a series of attacks in the past month leveraging compromised VPN credentials and CVE-2024-40711 to...
