CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3606
https://notcve.org/view.php?id=CVE-2021-3606
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe). OpenVPN versiones anteriores a 2.5.3 en Windows permite a usuarios locales cargar bibliotecas arbitrarias de carga dinámica por medio de un archivo de configuración de OpenSSL si está presente, permitiendo a un usuario ejecutar código arbitrario con el mismo nivel de privilegio que el proceso principal de OpenVPN (openvpn.exe) • https://community.openvpn.net/openvpn/wiki/CVE-2021-3606 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 2%CPEs: 10EXPL: 0CVE-2020-15078
https://notcve.org/view.php?id=CVE-2020-15078
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks. OpenVPN versiones 2.5.1 y anteriores, permiten a atacantes remotos omitir la autenticación y los datos del canal de control de acceso en servidores configurados con autenticación diferida, que pueden ser usados para desencadenar potencialmente más fugas de información • https://community.openvpn.net/openvpn/wiki/CVE-2020-15078 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ • CWE-305: Authentication Bypass by Primary Weakness CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27569
https://notcve.org/view.php?id=CVE-2020-27569
Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a location that is world writable and can be leveraged to gain write access to any file on the system. Se presenta una Escritura de Archivos Arbitraria en Aviatrix VPN Client versiones 2.8.2 y anteriores. El servicio VPN escribe registros en una ubicación que es de tipo world writable y puede ser aprovechado para conseguir acceso de escritura a cualquier archivo del sistema • https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-abitrary-file-write • CWE-276: Incorrect Default Permissions •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7224
https://notcve.org/view.php?id=CVE-2020-7224
The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the parameters could allow unauthorized third-party libraries to load. El cliente Aviatrix OpenVPN versiones hasta 2.5.7 en Linux, macOS y Windows, es vulnerable cuando los parámetros OpenSSL son alterados a partir de un conjunto de valores emitidos; los parámetros podrían permitir que se carguen bibliotecas de terceros no autorizadas. • https://docs.aviatrix.com/#security-bulletin https://docs.aviatrix.com/HowTos/security_bulletin_article.html https://docs.aviatrix.com/HowTos/security_bulletin_article.html#article-avxsb-00001 •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7544
https://notcve.org/view.php?id=CVE-2018-7544
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a "signal SIGTERM" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning ** EN DISPUTA ** Se ha descubierto un problema en la interfaz de gestión en OpenVPN hasta la versión 2.4.5. • http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html • CWE-134: Use of Externally-Controlled Format String •