107 matches found
PT-2023-18850 · Connectwise · Connectwise Automate
Name of the Vulnerable Software and Affected Versions: Connectwise Automate version 2022.11 Description: The issue concerns cleartext authentication, where authentication is performed via HTTP with SSL disabled. This is reportedly controlled by a configuration option, allowing customers to choose...
CVE-2023-23130
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP cleartext with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP rather than HTTPS durin...
CVE-2023-23126
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack...
PT-2023-18847 · Connectwise · Connectwise Automate
Name of the Vulnerable Software and Affected Versions: Connectwise Automate version 2022.11 Description: The issue allows the login screen to be iframed, potentially manipulating users into performing unintended actions. The vendor claims that a Content-Security-Policy HTTP response header is...
CVE-2023-23130
CVE-2023-23130 affects ConnectWise Automate 2022.11. The issue is cleartext authentication exposed over HTTP with SSL disabled, meaning credentials and session data could be exposed on the network. Several sources (NVD, Red Hat advisory, CVE records) describe this as an authentication flaw where ...
CVE-2023-23130
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP cleartext with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP rather than HTTPS durin...
CVE-2023-23126
ConnectWise Automate 2022.11 is affected by a clickjacking vulnerability where the login screen can be framed to entice users into unintended actions. The vendor claims a Content-Security-Policy header blocks this attack. Multiple sources (NVD, Red Hat, CVE listings) confirm the issue; no explici...
The vulnerability of the ConnectWise Automate software for remote monitoring and management of IT assets stems from incorrect restrictions on XML links to external objects. This allows attackers to execute arbitrary code or gain unauthorized access to protected information.
The vulnerability of the software for remote monitoring and management of IT assets in ConnectWise Automate relates to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or gain unauthorized access to...
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132...
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132...
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132...
Xxe
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132...
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132...
CVE-2021-35066
Summary: CVE-2021-35066 is an XXE vulnerability in ConnectWise Automate prior to 2021.0.6.132. The root cause is improper handling of XML external entities in the product’s processing, allowing an attacker to potentially access sensitive data or other impact as described by CVSS, with high-severi...
ConnectWise Automate 代码问题漏洞
Connectwise ConnectWise Automate is a cloud-based, local IT automation solution from ConnectWise Connectwise USA. The product supports content management, file sharing, IT asset tracking and management, and more. A security vulnerability exists in versions prior to ConnectWise automation...
CVE-2021-32582
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...
CVE-2021-32582
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...
Sql injection
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...
CVE-2021-32582
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...
CVE-2021-32582
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...