CVE-2018-15490

ExpressVPN for Windows contains a path traversal vulnerability in the JSON-RPC methods XVPN.GetPreference and XVPN.SetPreference within the Xvpnd.exe service (running with SYSTEM privileges). The Xvpnd RPC interface listens on TCP port 2015 and communicates over HTTP, allowing a local attacker to...