Richard Warren
David Cash- 26 Nov, 2024
Introducing NachoVPN: One VPN Server to Pwn Them All
Is Your Corporate VPN Client Providing Access to More Than Just Your Employees?
Read Article-
Richard Warren
- 08 Oct, 2024
Ivanti Connect Secure - Authenticated RCE via OpenSSL CRLF Injection (CVE-2024-37404)
Summary Ivanti Connect Secure versions prior to 22.7R2.1 and 22.7R2.2, and Ivanti Policy Secure versions prior to 22.
Read Article-
David Cash
-
Richard Warren
- 17 Sep, 2024
Skeleton Cookie: Breaking into Safeguard with CVE-2024-45488
Join us as we reveal how CVE-2024-45488 can let attackers gain access to your corporate password vault and uncover hidden secrets of Microsoft DPAPI.
Read Article-
David Cash
-
Richard Warren
- 04 Sep, 2024
One Identity SafeGuard for Privileged Passwords - Authentication Bypass (CVE-2024-45488)
SafeGuard for Privileged Passwords (SPP) virtual appliance images contain a hard-coded cryptographic key (CWE-321). An attacker can exploit this key …
Read Article-
Richard Warren
-
David Cash
- 31 Jul, 2024
Cato Client - Local Privilege Escalation via OpenSSL Configuration File (CVE-2024-6975)
The OpenSSL implementation in the winvpnclient.cli.exe service executable is configured to load an openssl.cnf file from a location that does not …
Read Article-
Richard Warren
-
David Cash
- 31 Jul, 2024
Cato Client - Local Privilege Escalation via Self-Upgrade (CVE-2024-6974)
The Cato Client was found to use an insecure temporary folder for downloading and processing updates.
Read Article-
Richard Warren
-
David Cash
- 31 Jul, 2024
Cato Client - Local Root Certificate Install as Low Privileged User (CVE-2024-6978)
The Cato Client allows a low-privileged, local user to install arbitrary Root CA Certificates in the computer’s certificate store.
Read Article