CVE Feed

    Dashboard / CVE / CVE-2018-18656

    CVE-2018-18656

    The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext. The location of such files is %PROGRAMDATA%\purevpn\config\login.conf. Additionally, all local users can read this file.

    Published:Oct 26, 2018
    Last Modified:Nov 21, 2024
    EPS:Oct 26, 2018
    EPSS Score:0.00044
    CVSS Score:7.8

    Affected Products

    Vendor
    Purevpn
    Product
    Purevpn

    Exploits

    https://www.trustwave.com/Resources/SpiderLabs-Blog/Credential-Leak-Flaws-in-Windows-PureVPN-Client/https://www.trustwave.com/Resources/SpiderLabs-Blog/Credential-Leak-Flaws-in-Windows-PureVPN-Client/

    Related CVEs

    CVE-2025-59691 (CVSS 3.7) — PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel …
    CVE-2025-59692 (CVSS 3.7) — PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's exi…
    CVE-2023-48957 (CVSS 5.3) — PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN t…
    CVE-2018-10204 (CVSS 8.8) — PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" servic…
    CVE-2018-7484 (CVSS 7.8) — An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone gr…
    CVE-2018-6822 (CVSS 9.8) — In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High