Search
Find a vulnerability
Search criteria
10 vulnerabilities found for vpn_client by aviatrix
CVE-2021-31776 (GCVE-0-2021-31776)
Vulnerability from nvd – Published: 2021-04-29 00:03 – Updated: 2024-08-03 23:03
VLAI
EPSS
VEX
Summary
Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/Downloads/samlclient.html | x_refsource_MISC |
| https://docs.aviatrix.com/HowTos/changelog.html#a… | x_refsource_CONFIRM |
| https://docs.aviatrix.com/Downloads/samlclient.ht… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:03:33.855Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-29T00:03:56.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-31776",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/Downloads/samlclient.html",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/Downloads/samlclient.html"
},
{
"name": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog",
"refsource": "CONFIRM",
"url": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog"
},
{
"name": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-31776",
"datePublished": "2021-04-29T00:03:56.000Z",
"dateReserved": "2021-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:03:33.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-13417 (GCVE-0-2020-13417)
Vulnerability from nvd – Published: 2020-05-22 20:47 – Updated: 2024-08-04 12:18
VLAI
EPSS
VEX
Summary
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/security_bulleti… | x_refsource_MISC |
| https://www.criticalstart.com/multiple-vulnerabil… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:18:17.893Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-17T20:20:30.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-13417",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege"
},
{
"name": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/",
"refsource": "MISC",
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-13417",
"datePublished": "2020-05-22T20:47:37.000Z",
"dateReserved": "2020-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:18:17.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-13413 (GCVE-0-2020-13413)
Vulnerability from nvd – Published: 2020-05-22 20:48 – Updated: 2024-08-04 12:18
VLAI
EPSS
VEX
Summary
An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/security_bulleti… | x_refsource_MISC |
| https://www.criticalstart.com/multiple-vulnerabil… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:18:18.168Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-17T20:19:44.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-13413",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api"
},
{
"name": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/",
"refsource": "MISC",
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-13413",
"datePublished": "2020-05-22T20:48:39.000Z",
"dateReserved": "2020-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:18:18.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-17388 (GCVE-0-2019-17388)
Vulnerability from nvd – Published: 2019-12-05 17:08 – Updated: 2024-08-05 01:40
VLAI
EPSS
VEX
Summary
Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html | x_refsource_MISC |
| https://immersivelabs.com/blog/ | x_refsource_MISC |
| https://immersivelabs.com/2019/12/04/aviatrix-vpn… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.622Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-05T17:08:39.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17388",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"name": "https://immersivelabs.com/blog/",
"refsource": "MISC",
"url": "https://immersivelabs.com/blog/"
},
{
"name": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/",
"refsource": "MISC",
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17388",
"datePublished": "2019-12-05T17:08:39.000Z",
"dateReserved": "2019-10-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:40:15.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-17387 (GCVE-0-2019-17387)
Vulnerability from nvd – Published: 2019-12-05 17:07 – Updated: 2024-08-05 01:40
VLAI
EPSS
VEX
Summary
An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html | x_refsource_MISC |
| https://immersivelabs.com/blog/ | x_refsource_MISC |
| https://immersivelabs.com/2019/12/04/aviatrix-vpn… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.304Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-05T17:07:48.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17387",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"name": "https://immersivelabs.com/blog/",
"refsource": "MISC",
"url": "https://immersivelabs.com/blog/"
},
{
"name": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/",
"refsource": "MISC",
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17387",
"datePublished": "2019-12-05T17:07:48.000Z",
"dateReserved": "2019-10-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:40:15.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-31776 (GCVE-0-2021-31776)
Vulnerability from cvelistv5 – Published: 2021-04-29 00:03 – Updated: 2024-08-03 23:03
VLAI
EPSS
VEX
Summary
Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/Downloads/samlclient.html | x_refsource_MISC |
| https://docs.aviatrix.com/HowTos/changelog.html#a… | x_refsource_CONFIRM |
| https://docs.aviatrix.com/Downloads/samlclient.ht… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:03:33.855Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-29T00:03:56.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-31776",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/Downloads/samlclient.html",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/Downloads/samlclient.html"
},
{
"name": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog",
"refsource": "CONFIRM",
"url": "https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog"
},
{
"name": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/Downloads/samlclient.html#windows-win"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-31776",
"datePublished": "2021-04-29T00:03:56.000Z",
"dateReserved": "2021-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:03:33.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-13413 (GCVE-0-2020-13413)
Vulnerability from cvelistv5 – Published: 2020-05-22 20:48 – Updated: 2024-08-04 12:18
VLAI
EPSS
VEX
Summary
An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/security_bulleti… | x_refsource_MISC |
| https://www.criticalstart.com/multiple-vulnerabil… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:18:18.168Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-17T20:19:44.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-13413",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api"
},
{
"name": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/",
"refsource": "MISC",
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-13413",
"datePublished": "2020-05-22T20:48:39.000Z",
"dateReserved": "2020-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:18:18.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-13417 (GCVE-0-2020-13417)
Vulnerability from cvelistv5 – Published: 2020-05-22 20:47 – Updated: 2024-08-04 12:18
VLAI
EPSS
VEX
Summary
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/security_bulleti… | x_refsource_MISC |
| https://www.criticalstart.com/multiple-vulnerabil… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:18:17.893Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-17T20:20:30.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-13417",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege"
},
{
"name": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/",
"refsource": "MISC",
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-13417",
"datePublished": "2020-05-22T20:47:37.000Z",
"dateReserved": "2020-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:18:17.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-17388 (GCVE-0-2019-17388)
Vulnerability from cvelistv5 – Published: 2019-12-05 17:08 – Updated: 2024-08-05 01:40
VLAI
EPSS
VEX
Summary
Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html | x_refsource_MISC |
| https://immersivelabs.com/blog/ | x_refsource_MISC |
| https://immersivelabs.com/2019/12/04/aviatrix-vpn… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.622Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-05T17:08:39.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17388",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"name": "https://immersivelabs.com/blog/",
"refsource": "MISC",
"url": "https://immersivelabs.com/blog/"
},
{
"name": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/",
"refsource": "MISC",
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17388",
"datePublished": "2019-12-05T17:08:39.000Z",
"dateReserved": "2019-10-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:40:15.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-17387 (GCVE-0-2019-17387)
Vulnerability from cvelistv5 – Published: 2019-12-05 17:07 – Updated: 2024-08-05 01:40
VLAI
EPSS
VEX
Summary
An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html | x_refsource_MISC |
| https://immersivelabs.com/blog/ | x_refsource_MISC |
| https://immersivelabs.com/2019/12/04/aviatrix-vpn… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.304Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-05T17:07:48.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/blog/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17387",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html",
"refsource": "MISC",
"url": "https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html"
},
{
"name": "https://immersivelabs.com/blog/",
"refsource": "MISC",
"url": "https://immersivelabs.com/blog/"
},
{
"name": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/",
"refsource": "MISC",
"url": "https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17387",
"datePublished": "2019-12-05T17:07:48.000Z",
"dateReserved": "2019-10-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:40:15.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}