Vulnerabilities > Openvpn > Critical

DATE CVE VULNERABILITY TITLE RISK
2024-07-08 CVE-2024-27903 Unrestricted Upload of File with Dangerous Type vulnerability in Openvpn
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
network
low complexity
openvpn CWE-434
critical
9.8
2023-11-11 CVE-2023-46850 Use After Free vulnerability in multiple products
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
network
low complexity
openvpn debian fedoraproject CWE-416
critical
9.8
2022-03-18 CVE-2022-0547 Improper Authentication vulnerability in multiple products
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
network
low complexity
openvpn fedoraproject debian CWE-287
critical
9.8
2018-03-16 CVE-2018-7544 Use of Externally-Controlled Format String vulnerability in Openvpn
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5.
network
low complexity
openvpn CWE-134
critical
9.1
2006-04-06 CVE-2006-1629 Remote Code Execution vulnerability in Openvpn and Openvpn Access Server
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.
network
low complexity
openvpn
critical
9.0