Vulnerabilities

TI-2024-16926 CVE-2024-25728 · GHSA-vpg2-32g8-56wf

ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests…

MEDIUM 40

ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00669 Published 2024-02-11 No fix listed CWE-922

TI-2020-17608 CVE-2020-29238 · GHSA-647h-v8f6-577g

An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows…

MEDIUM 49

An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.16483 Published 2021-03-10 No fix listed CWE-190

TI-2018-11046 CVE-2018-15490 · GHSA-f5mw-fw9m-vxmc

An issue was discovered in ExpressVPN on Windows.

LOW 32

An issue was discovered in ExpressVPN on Windows.

CVSS 3.0HIGH 7.1 Local Low privileges No interaction EPSS 0.00609 Published 2019-01-02 No fix listed CWE-22

Vulnerabilities

Filters

ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests…

An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows…

An issue was discovered in ExpressVPN on Windows.