CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-41717
https://notcve.org/view.php?id=CVE-2023-41717
Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. El control inadecuado del tipo de archivo en las versiones 3.6.1.25 y anteriores de Zscaler Proxy permite a los atacantes locales eludir las restricciones de descarga/subida de archivos. • https://github.com/federella/CVE-2023-41717 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 8.1EPSS: 0%CPEs: 6EXPL: 0CVE-2023-28800 – Output encoding missing in redrurl parameter
https://notcve.org/view.php?id=CVE-2023-28800
When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login. • https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246 https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706 https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome%20OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771 https:&#x • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 0%CPEs: 6EXPL: 0CVE-2023-28799
https://notcve.org/view.php?id=CVE-2023-28799
A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain. • https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246 https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706 https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome%20OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771 https:&#x • CWE-20: Improper Input Validation CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11634
https://notcve.org/view.php?id=CVE-2020-11634
The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context. El Zscaler Client Connector para Windows anterior a versión 2.1.2.105, presentaba una vulnerabilidad de secuestro DLL causada debido a la configuración de OpenSSL. Un adversario local puede ser capaz de ejecutar código arbitrario en el contexto SYSTEM • https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2020?applicable_category=Windows&applicable_version=2.1.2.105 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11632
https://notcve.org/view.php?id=CVE-2020-11632
The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges. El Zscaler Client Connector anterior a versión 2.1.2.150, no citaba la ruta de búsqueda de servicios, lo que permite a un adversario local ejecutar código con privilegios del sistema • https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2020?applicable_category=Windows&applicable_version=2.1.2.105 • CWE-428: Unquoted Search Path or Element •