Filtered by vendor Cyberghostvpn Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-30237 1 Cyberghostvpn 1 Cyberghost 2023-05-16 7.8 High
CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.
CVE-2018-10646 1 Cyberghostvpn 1 Cyberghost 2019-10-03 N/A
CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service. This service establishes a NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "ConnectToVpnServer" method accepts a "connectionParams" argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.