Vulnerabilities > Openvpn > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-08 | CVE-2023-7224 | Code Injection vulnerability in Openvpn Connect OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable | 7.8 |
| 2023-11-11 | CVE-2023-46849 | Divide By Zero vulnerability in multiple products Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service. | 7.5 |
| 2023-08-22 | CVE-2020-20813 | Unspecified vulnerability in Openvpn Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. | 7.5 |
| 2022-07-06 | CVE-2022-33737 | Information Exposure Through Log Files vulnerability in Openvpn Access Server The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password | 7.5 |
| 2021-07-12 | CVE-2021-3547 | Improper Certificate Validation vulnerability in Openvpn 3.6/3.6.1 OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration. | 7.4 |
| 2021-05-26 | CVE-2020-15076 | Link Following vulnerability in Openvpn Private Tunnel Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp. | 7.2 |
| 2021-04-26 | CVE-2020-15078 | Missing Authentication for Critical Function vulnerability in multiple products OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks. | 7.5 |
| 2020-02-28 | CVE-2020-9442 | Improper Preservation of Permissions vulnerability in Openvpn Connect 3.1.0.361 OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there. | 7.2 |
| 2020-02-13 | CVE-2020-8953 | Improper Authentication vulnerability in Openvpn Access Server 2.8.0 OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). | 7.5 |
| 2008-08-04 | CVE-2008-3459 | Configuration vulnerability in Openvpn 2.1 Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters. | 7.6 |