Richard Warren
David Cash- 26 Nov, 2024
Introducing NachoVPN: One VPN Server to Pwn Them All
Is Your Corporate VPN Client Providing Access to More Than Just Your Employees?
Read Article-
David Cash
-
Richard Warren
- 26 Nov, 2024
Palo Alto GlobalProtect - RCE and Privilege Escalation via Malicious VPN Server (CVE-2024-5921)
Summary Both the Windows and macOS versions of the GlobalProtect VPN client are vulnerable to remote code execution (RCE) and privilege escalation via …
Read Article-
David Cash
-
Richard Warren
- 26 Nov, 2024
SonicWall NetExtender for Windows - RCE as SYSTEM via EPC Client Update (CVE-2024-29014)
Summary The SonicWALL NetExtender VPN client for Windows, version 10.2.339 and earlier, contains a vulnerability allowing remote code execution (RCE) …
Read Article-
Richard Warren
- 08 Oct, 2024
Ivanti Connect Secure - Authenticated RCE via OpenSSL CRLF Injection (CVE-2024-37404)
Summary Ivanti Connect Secure versions prior to 22.7R2.1 and 22.7R2.2, and Ivanti Policy Secure versions prior to 22.
Read Article-
David Cash
-
Richard Warren
- 17 Sep, 2024
Skeleton Cookie: Breaking into Safeguard with CVE-2024-45488
Join us as we reveal how CVE-2024-45488 can let attackers gain access to your corporate password vault and uncover hidden secrets of Microsoft DPAPI.
Read Article-
David Cash
-
Richard Warren
- 04 Sep, 2024
One Identity SafeGuard for Privileged Passwords - Authentication Bypass (CVE-2024-45488)
SafeGuard for Privileged Passwords (SPP) virtual appliance images contain a hard-coded cryptographic key (CWE-321). An attacker can exploit this key …
Read Article