CVE-2020-13417

CVE-2020-13417 is an Elevation of Privilege affecting Aviatrix VPN Client, linked to an incomplete fix for CVE-2020-7224. Connected sources confirm the issue occurs on Linux, macOS, and Windows installations when OpenSSL parameters are altered from the issued values, enabling loading of unauthori...

CVE-2020-13413

CVE-2020-13413 affects Aviatrix Controller prior to version 5.4.1204. The issue is an observable response discrepancy in the API that makes it easier to enumerate valid usernames via brute force. Public references across multiple feeds describe this information disclosure vulnerability tying to u...

CVE-2019-17387

Aviatrix VPN Client AVPNC_RP service (versions up to 2.2.10) contains an authentication flaw that allows local attackers to execute arbitrary code and escalate privileges on Windows, Linux, and macOS. The vulnerability is described as a local privilege escalation via an authentication weakness, w...

CVE-2021-31776

CVE-2021-31776 affects Aviatrix VPN Client on Windows prior to 2.14.14. The vulnerability is an unquoted search path that enables local privilege escalation to the SYSTEM user when a machine is misconfigured to allow unprivileged users to write to administrator-only directories. Red Hat and CNVD ...

CVE-2019-17388

CVE-2019-17388 applies to the Aviatrix VPN Client (up to version 2.2.10) and is caused by weak file permissions in the installation directory on Windows and Linux. This project-level issue allows a local attacker to modify files to gain elevated privileges and execute arbitrary code. Public docum...