Product:

Controller

(Aviatrix)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 15
Date Id Summary Products Score Patch Annotated
2020-05-22 CVE-2020-13415 An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping. Controller 7.5
2020-05-22 CVE-2020-13416 An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for password resets. Controller 6.5
2020-05-22 CVE-2020-13417 An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters. Controller, Gateway, Vpn_client 9.8
2020-11-17 CVE-2020-26548 An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system. Controller 8.8
2020-11-17 CVE-2020-26549 An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests to directories can be bypassed for file downloading. Controller 7.5
2020-11-17 CVE-2020-26550 An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-character key. Controller 7.5
2020-11-17 CVE-2020-26552 An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a valid session ID for access. Controller 7.5
2020-11-17 CVE-2020-26551 An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file. Controller 7.5
2020-11-17 CVE-2020-26553 An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to the web tree. Controller 9.8
2021-04-21 CVE-2020-27568 Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller resource. Note: All Aviatrix appliances are fully encrypted. This is an extra layer of security. Controller 7.5