Vulnerabilities > Openvpn > Critical

DATE CVE VULNERABILITY TITLE RISK
2024-07-08 CVE-2024-27903 Unrestricted Upload of File with Dangerous Type vulnerability in Openvpn
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
network
low complexity
openvpn CWE-434
critical
9.8
2023-11-11 CVE-2023-46850 Use After Free vulnerability in multiple products
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
network
low complexity
openvpn debian fedoraproject CWE-416
critical
9.8
2022-03-18 CVE-2022-0547 Improper Authentication vulnerability in multiple products
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
network
low complexity
openvpn fedoraproject debian CWE-287
critical
9.8
2020-02-13 CVE-2020-8953 Improper Authentication vulnerability in Openvpn Access Server 2.8.0
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication).
network
low complexity
openvpn CWE-287
critical
9.8
2018-03-16 CVE-2018-7544 Use of Externally-Controlled Format String vulnerability in Openvpn
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5.
network
low complexity
openvpn CWE-134
critical
9.1
2017-10-04 CVE-2017-12166 Out-of-bounds Write vulnerability in multiple products
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
network
low complexity
openvpn debian CWE-787
critical
9.8