Vulnerabilities > Openvpn > High

DATE CVE VULNERABILITY TITLE RISK
2021-07-02 CVE-2021-3613 Uncontrolled Search Path Element vulnerability in Openvpn Connect
OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe).
local
low complexity
openvpn CWE-427
7.8
2021-06-04 CVE-2020-36382 Reachable Assertion vulnerability in Openvpn Access Server
OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service.
network
low complexity
openvpn CWE-617
7.5
2021-05-26 CVE-2020-15076 Link Following vulnerability in Openvpn Private Tunnel
Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp.
local
low complexity
openvpn CWE-59
7.8
2021-04-26 CVE-2020-15078 Missing Authentication for Critical Function vulnerability in multiple products
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
network
low complexity
openvpn fedoraproject canonical debian CWE-306
7.5
2021-03-30 CVE-2020-15075 Link Following vulnerability in Openvpn Connect
OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp.
local
low complexity
openvpn CWE-59
7.1
2020-07-14 CVE-2020-15074 Insufficient Session Expiration vulnerability in Openvpn Access Server
OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.
network
low complexity
openvpn CWE-613
7.5
2020-05-04 CVE-2020-11462 XML Entity Expansion vulnerability in Openvpn Access Server
An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3.
network
low complexity
openvpn CWE-776
7.5
2020-02-28 CVE-2020-9442 Improper Preservation of Permissions vulnerability in Openvpn Connect
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.
local
low complexity
openvpn CWE-281
7.8
2018-05-01 CVE-2018-9336 Double Free vulnerability in multiple products
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service.
local
low complexity
openvpn slackware CWE-415
7.8
2017-06-27 CVE-2017-7520 Out-of-bounds Read vulnerability in Openvpn
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
network
high complexity
openvpn CWE-125
7.4