374 matches found
Critical RCE Vulnerability Reported in ConnectWise Server Backup Solution
IT service management software platform ConnectWise has released Software patches for a critical security vulnerability in Recover and R1Soft Server Backup Manager SBM. The issue, characterized as a "neutralization of Special Elements in Output Used by a Downstream Component," could be abused to...
CVE-2022-36781
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting...
CVE-2022-36781
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting...
CVE-2022-36781 ConnectWise - ScreenConnect Session Code Bypass
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting...
ConnectWise ScreenConnect 安全漏洞
ConnectWise ScreenConnect is a self-hosted remote desktop software application from ConnectWise. ConnectWise ScreenConnect suffers from a security vulnerability that stems from the fact that an attacker can use a proxy to monitor traffic and perform brute force operations on the session code to...
PT-2022-23620 · Connectwise · Connectwise Screenconnect
Name of the Vulnerable Software and Affected Versions: ConnectWise ScreenConnect versions 22.6 and below Description: The issue allows potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this to gain...
Malicious code in opsgenie-connectwise-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45eb34acac118701b9fce76014bda5547b8ef8ecb7fa3c5de42591eb484616f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5107 Malicious code in opsgenie-connectwise-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45eb34acac118701b9fce76014bda5547b8ef8ecb7fa3c5de42591eb484616f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-36537
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader. Recent assessments: ccondon-r7 at March 01, 2023 6:39pm UTC reported: The core vuln here is an info leak in ZK Framework, which ...
NetStandard attack should make Managed Service Providers sit up and take notice
Managed Service Providers MSPs, organizations that allow companies to outsource a variety of IT and security functions, are a growing market. Because they are a potential gateway to lots of company networks they make a very attractive target for cybercriminals. In a recent threat advisory Huntres...
The vulnerability of the ManagedIT.asmx component of the ConnectWise ManagedITSync plugin in the Kaseya VSA IT-infrastructure management platform allows a attacker to execute arbitrary SQL commands.
The vulnerability of the ManagedIT.asmx component of the ConnectWise ManagedITSync business management platform is related to the lack of validation for the validity of XML objects’ sequences. Exploiting this vulnerability could allow a malicious actor to execute arbitrary SQL commands through th...
ConnectWise ManagedITSync SQL Injection (CVE-2017-18362)
An SQL injection vulnerability exists in ConnectWise ManagedITSync. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...
ConnectWise Control 19.2.24707 - Username Enumeration
Exploit Title: ConnectWise Control 19.2.24707 - Username Enumeration Date: 17/12/2021 Exploit Author: Luca Cuzzolin aka czz78 Vendor Homepage: https://www.connectwise.com/ Version: vulnerable = 19.2.24707 CVE : CVE-2019-16516 https://github.com/czz/ScreenConnect-UserEnum from multiprocessing impo...
ConnectWise Control 19.2.24707 - Username Enumeration Exploit
Exploit Title: ConnectWise Control 19.2.24707 - Username Enumeration Exploit Author: Luca Cuzzolin aka czz78 Vendor Homepage: https://www.connectwise.com/ Version: vulnerable = 19.2.24707 CVE : CVE-2019-16516 https://github.com/czz/ScreenConnect-UserEnum from multiprocessing import Process, Queue...
ConnectWise Control 19.2.24707 Username Enumeration
Exploit Title: ConnectWise Control 19.2.24707 - Username Enumeration Date: 17/12/2021 Exploit Author: Luca Cuzzolin aka czz78 Vendor Homepage: https://www.connectwise.com/ Version: vulnerable = 19.2.24707 CVE : CVE-2019-16516 https://github.com/czz/ScreenConnect-UserEnum from multiprocessing impo...
The vulnerability of the ConnectWise Automate software for remote monitoring and management of IT assets stems from incorrect restrictions on XML links to external objects. This allows attackers to execute arbitrary code or gain unauthorized access to protected information.
The vulnerability of the software for remote monitoring and management of IT assets in ConnectWise Automate relates to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or gain unauthorized access to...
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132...
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132...
