Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Client_connector
(Zscaler)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 26 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2023-10-23 | CVE-2023-28797 | Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user. | Client_connector | 7.3 | ||
| 2023-10-23 | CVE-2023-28804 | An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105 | Client_connector | 5.3 | ||
| 2023-10-23 | CVE-2023-28803 | An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9. | Client_connector | 6.5 | ||
| 2023-10-23 | CVE-2023-28805 | An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105 | Client_connector | 9.8 | ||
| 2023-11-06 | CVE-2023-28794 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6. | Client_connector | 6.5 | ||
| 2023-11-21 | CVE-2023-28802 | An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149. | Client_connector | 5.4 | ||
| 2024-08-06 | CVE-2023-28806 | An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190. | Client_connector | 6.5 | ||
| 2024-08-06 | CVE-2024-23456 | Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled. | Client_connector | 7.5 | ||
| 2024-08-06 | CVE-2024-23458 | While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190. | Client_connector | 7.8 | ||
| 2024-08-06 | CVE-2024-23460 | The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2. | Client_connector | 7.8 |