CVE-2025-2172 | | | 2025-06-23 | Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing… |
CVE-2025-2171 | | | 2025-06-23 | Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute forc… |
CVE-2024-50603 | Critical | 10.0 | 2025-01-08 | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS… |
CVE-2022-38368 | High | 8.8 | 2022-08-15 | An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated… |
CVE-2021-40870 | Critical | 9.8 | 2021-09-13 | An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unaut… |
CVE-2021-31776 | High | 7.8 | 2021-04-29 | Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconf… |
CVE-2020-27569 | High | 7.5 | 2021-04-21 | Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a location that is world writable and can be leveraged to… |
CVE-2020-27568 | High | 7.5 | 2021-04-21 | Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller resource. Note: All… |
CVE-2020-26553 | Critical | 9.8 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to the web tree. |
CVE-2020-26552 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a valid session ID for… |
CVE-2020-26551 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file. |
CVE-2020-26550 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-characte… |
CVE-2020-26549 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests to directories can be bypassed for file… |
CVE-2020-26548 | High | 8.8 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the… |
CVE-2020-13417 | Critical | 9.8 | 2020-05-22 | An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS… |
CVE-2020-13416 | Medium | 6.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens… |
CVE-2020-13415 | High | 7.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (e… |
CVE-2020-13414 | High | 7.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software. |
CVE-2020-13413 | Medium | 5.3 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user… |
CVE-2020-13412 | High | 8.8 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSR… |
CVE-2020-7224 | Critical | 9.8 | 2020-04-16 | The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the paramet… |
CVE-2019-17388 | High | 7.8 | 2019-12-05 | Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary… |
CVE-2019-17387 | High | 7.8 | 2019-12-05 | An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code exec… |