CVE-2023-28804 Linux ZCC allows unsigned updates, allowing elevated Code Execution

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105...

CVE-2023-28804 Linux ZCC allows unsigned updates, allowing elevated Code Execution

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105...

CVE-2023-28804

The CVE-2023-28804 entry documents an improper verification of a cryptographic signature in Zscaler Client Connector on Linux, allowing an attacker to replace binaries. Affected product: Zscaler Client Connector for Linux, with vulnerable versions before 1.4.0.105. The issue enables binary replac...

CVE-2023-28803 Traffic being bypassed by ZCC by configuring synthetic IP range as local network

An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9...

CVE-2023-28803 Traffic being bypassed by ZCC by configuring synthetic IP range as local network

An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9...

CVE-2023-28797 LPE using arbitrary file delete with Symlinks

Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user...

CVE-2023-28796 IPC Bypass Through PLT Section in ELF

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28796 IPC Bypass Through PLT Section in ELF

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28796

CVE-2023-28796 affects Zscaler Client Connector for Linux prior to 1.3.1.6. The issue is an improper verification of the cryptographic signature that allows code injection. Impact is described as high confidentiality/integrity/availability concerns, with local attack vector and no user interactio...

CVE-2023-28795 Client IPC validation bypass

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28795

CVE-2023-28795 concerns Zscaler Client Connector for Linux prior to 1.3.1.6. The issue is described as an Origin Validation Error that allows inclusion of code in an existing process. Affected software is Zscaler Client Connector for Linux; root cause details indicate a failure in validating the ...

CVE-2023-28795 Client IPC validation bypass

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28793 Heap Based Buffer Overflow in Library

Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28793 Heap Based Buffer Overflow in Library

Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28793

CVE-2023-28793: A heap-based buffer overflow in the signelf library used by Zscaler Client Connector for Linux allows code injection. Affected: Zscaler Client Connector for Linux prior to 1.3.1.6. Exploitation requires local access (local vector) with low privileges. Root cause: overflow in signe...

CVE-2021-26738 Privilege Escalation for ZCC macOS via PATH Variable

Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges...

CVE-2021-26737 Privilege Escalation Using PID Reuse in ZCC macOS

The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition...

CVE-2021-26737

CVE-2021-26737 affects the Zscaler Client Connector for macOS prior to 3.6. The vulnerability arises from insufficient validation of RPC clients, allowing a local attacker with LOW privileges to exploit a race condition to shutdown the Zscaler tunnel (availability impact). The root cause is a rac...

CVE-2021-26736

CVE-2021-26736 concerns Zscaler Client Connector Installer and Uninstaller for Windows prior to version 3.6. The vulnerability allows a local attacker to execute binaries from a low-privilege path, potentially gaining SYSTEM privileges. Affected component: the Windows installer/uninstaller. Root ...

CVE-2021-26735 Untrusted Search Path While Executing REG DELETE by Uninstaller

The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges...