8740 matches found
Netgear SSL312 PROSAFE SSL VPN-Concentrator 25 - Error Page Cross-Site Scripting
source: https://www.securityfocus.com/bid/26073/info NETGEAR ProSafe SSL VPN Concentrator 25-SSL312 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attac...
Checkpoint VPN-1 / Firewall-1 multiple security vulnerabilities
Multiple buffer overflows / memory corruptions...
Check Point VPN-1/FireWall-1 4.1 SP2 Blocked Port Bypass Exploit
No description provided by source. / Summary A vulnerability exists in Check Point VPN-1/FireWall-1 4.1 SP2 that enables an attacker to establish connections to blocked TCP services through the firewall in certain configurations. We expect many deployed FireWall-1 installations to be immune to th...
A comprehensive analysis of the firewall and the firewall of penetration-vulnerability warning-the black bar safety net
A firewall description A firewall is a function, it makes the internal network and the external network or the Internet, isolated from each other, in order to protect the internal network or host. A simple firewall may consist of Router,3 Layer Switch ACL access control list to act as, you can al...
Cisco VPN Client on Windows Dial-up Networking Dialog Local Privilege Escalation
The version of the Cisco VPN client installed on the remote host reportedly allows an unprivileged local user to elevate his privileges to the LocalSystem account by enabling the 'Start Before Login' feature and configuring a VPN profile to use Microsoft's Dial-Up Networking interface. C Tenable...
Symantec企业防火墙用户名枚举漏洞
BUGTRAQ ID: 25338 Symantec Enterprise Firewall（SEP）是一个高性能防火墙解决方案，适用于WINDOWS和SOLARIS操作系统。 SEP在处理某种认证请求时存在漏洞，远程攻击者可能利用此漏洞暴力猜测有效的用户名。 如果对Symantec企业防火墙配置了使用预共享密钥（PSK）认证的远程访问（客户端到网关）VPN的话，就会对有效和无效用户名提供不同的响应。这就允许攻击者判断所猜测的用户名是否有效，但不会列出有效的用户名，仅可以确定所提供的用户名是否存在。 Symantec Enterprise Firewall 6.x 临时解决方法：...
Windows平台的Cisco VPN客户端多个本地权限提升漏洞
BUGTRAQ ID: 25332 Cisco VPN客户端允许用户创建到支持Cisco VPN设备的IPSec VPN隧道。 Microsoft Windows的Cisco VPN客户端中存在两个漏洞，允许本地非特权用户提升权限。 1. 通过Microsoft Windows拨号网络接口的本地权限提升 非特权用户可以通过启用Start Before Logon（SBL）功能并配置VPN配置使用Microsoft拨号网络接口将权限提升到LocalSystem帐号用户的权限。如果同时启用并配置了这两个设置，就可以在Windows登录窗口中使用Cisco...
Code injection
Cisco VPN Client on Windows before 4.8.02.0010 allows local users to gain privileges by enabling the "Start Before Logon" SBL and Microsoft Dial-Up Networking options, and then interacting with the dial-up networking dialog box...
Code injection
Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield IS release, uses weak permissions for cvpnd.exe Modify granted to Interactive Users, which allows local users to gain privileges via a modified cvpnd.exe...
Authentication flaw
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key PSK authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...
CVE-2007-4414
Cisco VPN Client on Windows before 4.8.02.0010 allows local users to gain privileges by enabling the "Start Before Logon" SBL and Microsoft Dial-Up Networking options, and then interacting with the dial-up networking dialog box...
CVE-2007-4415
Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield IS release, uses weak permissions for cvpnd.exe Modify granted to Interactive Users, which allows local users to gain privileges via a modified cvpnd.exe...
CVE-2007-4422
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key PSK authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...
CVE-2007-4422
CVE-2007-4422 affects Symantec Enterprise Firewall 6.x: the login interface used with a VPN using pre-shared key (PSK) authentication leaks information by returning different responses for valid vs invalid usernames, enabling remote username enumeration. The available connected documents confirm ...
CVE-2007-4415
Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield IS release, uses weak permissions for cvpnd.exe Modify granted to Interactive Users, which allows local users to gain privileges via a modified cvpnd.exe...
CVE-2007-4414
Cisco VPN Client on Windows before 4.8.02.0010 allows local users to gain privileges by enabling the "Start Before Logon" SBL and Microsoft Dial-Up Networking options, and then interacting with the dial-up networking dialog box...
CVE-2007-4422
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key PSK authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...
CVE-2007-4415
CVE-2007-4415 affects Cisco VPN Client on Windows before 5.0.01.0600 (and the 5.0.01.0600 InstallShield release). The root cause is insecure permissions on cvpnd.exe (Modify granted to Interactive Users), enabling local privilege escalation by replacing cvpnd.exe. Impact is local privilege escala...
CVE-2007-4414
Cisco VPN Client on Windows before 4.8.02.0010 allows an unprivileged local user to escalate to LocalSystem by enabling Start Before Logon and Microsoft Dial-Up Networking, then interacting with the dial-up dialog. A fix is available in 4.8.02.0010 or later; apply the Cisco advisory (cisco-sa-200...