CVE-2018-10169

ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

Privilege escalation

ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

CVE-2018-10170

NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

Privilege escalation

NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

CVE-2018-10170

NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

CVE-2018-10169

ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

CVE-2018-10169

Concretely, CVE-2018-10169 affects ProtonVPN for Windows (ProtonVPN 1.3.3) via the ProtonVPN Service. The service exposes a NetNamedPipe endpoint; the Connect method passes an OpenVPN configuration to a helper that runs with SYSTEM privileges. An attacker can inject a malicious OpenVPN config (e....

CVE-2018-10169

ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

CVE-2018-10170

NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

CVE-2018-10170

Summary: CVE-2018-10170 affects NordVPN 6.12.7.0 for Windows. A NetNamedPipe endpoint exposed by the nordvpn-service allows arbitrary local applications to connect and invoke publicly exposed methods. The Connect method accepts an argument that enables attacker control of the OpenVPN command line...

CVE-2018-10170: Incorrect Permission Assignment for Critical Resource

NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

CVE-2018-10169: Incorrect Permission Assignment for Critical Resource

ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a...

PT-2018-1296

Name of the Vulnerable Software and Affected Versions NordVPN version 6.12.7.0 Description The issue is related to the "nordvpn-service" service, which establishes a NetNamedPipe endpoint. This allows arbitrary installed applications to connect and call publicly exposed methods, including the...

Moxa EDR-810 Web Server OpenVPN Config Multiple Command Injection Vulnerabilities(CVE-2017-14432 - CVE-2017-14434)

Summary An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into various paramaters in the...

CVE-2018-10066

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network fo...

CVE-2018-10066

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network fo...

CVE-2018-10066

CVE-2018-10066 affects MikroTik RouterOS 6.41.4. The issue is missing OpenVPN server certificate verification, allowing a remote unauthenticated attacker who can intercept client traffic to impersonate a legitimate OpenVPN server and potentially access the client’s internal network (e.g., via sit...

CVE-2018-10066: Improper Certificate Validation

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network fo...

PT-2018-9652

Name of the Vulnerable Software and Affected Versions: MikroTik RouterOS version 6.41.4 Description: An issue in MikroTik RouterOS allows a remote unauthenticated attacker to act as a malicious OpenVPN server by exploiting missing OpenVPN server certificate verification. This could enable the...

MikroTik RouterOS Elevation of Privilege Vulnerability

MikroTik RouterOS is a set of routing operating system developed based on Linux core by MikroTik Latvia. The system turns a PC computer into a professional router. A security vulnerability exists in MikroTik RouterOS version 6.41.4, which stems from the program's lack of OpenVPN server certificat...