Vulnerabilities > Openvpn > Openvpn
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-11-11 | CVE-2023-46849 | Divide By Zero vulnerability in multiple products Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service. | 7.5 |
| 2023-11-11 | CVE-2023-46850 | Use After Free vulnerability in multiple products Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. | 9.8 |
| 2023-08-22 | CVE-2020-20813 | Unspecified vulnerability in Openvpn Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. | 7.5 |
| 2022-03-18 | CVE-2022-0547 | Improper Authentication vulnerability in multiple products OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials. | 9.8 |
| 2021-07-12 | CVE-2021-3547 | Improper Certificate Validation vulnerability in Openvpn 3.6/3.6.1 OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration. | 7.4 |
| 2021-07-02 | CVE-2021-3606 | Uncontrolled Search Path Element vulnerability in Openvpn OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe). | 4.4 |
| 2021-04-26 | CVE-2020-15078 | Missing Authentication for Critical Function vulnerability in multiple products OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks. | 7.5 |
| 2020-04-27 | CVE-2020-11810 | Race Condition vulnerability in multiple products An issue was discovered in OpenVPN 2.4.x before 2.4.9. | 3.7 |
| 2018-05-01 | CVE-2018-9336 | Double Free vulnerability in multiple products openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. | 4.6 |
| 2018-03-16 | CVE-2018-7544 | Use of Externally-Controlled Format String vulnerability in Openvpn A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. | 9.1 |