CVE-2019-16514

CVE-2019-16514 affects ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185. The server allows remote code execution: an unsigned extension ZIP uploaded by an administrative user can contain executable code that is then executed on the server. This is corroborated by NVD and Red Hat entri...

CVE-2019-16514

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server...

CVE-2019-16517

ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185 is affected by a CORS misconfiguration that reflects the Origin header, enabling JavaScript from any domain to interact with server APIs and perform administrative actions without user knowledge. Public sources in the connected document...

CVE-2019-16517

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative...

CVE-2019-16512

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. There is stored XSS in the Appearance modifier...

CVE-2019-16513

ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185 is affected by a CSRF issue that can be used to send API requests without user authorization. The root cause is CSRF in the web/API surface, enabling potentially unauthorized actions via forged requests. Concrete impact is partial to hi...

CVE-2019-16513

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. CSRF can be used to send API requests...

PT-2020-9833

Name of the Vulnerable Software and Affected Versions ConnectWise Control versions 19.3.25270.7185 Description A CORS misconfiguration issue allows JavaScript running on any domain to interact with the server APIs, enabling administrative actions without the victim's knowledge. This is due to the...

PT-2020-9831

Name of the Vulnerable Software and Affected Versions ConnectWise Control version 19.3.25270.7185 Description An issue was discovered where certain HTTP security headers are not used, which could potentially lead to security risks. Recommendations For ConnectWise Control version 19.3.25270.7185,...

PT-2020-9828

Name of the Vulnerable Software and Affected Versions ConnectWise Control version 19.3.25270.7185 Description An issue was discovered in ConnectWise Control, where there is stored XSS in the Appearance modifier. Recommendations For version 19.3.25270.7185, update to a newer version that contains ...

PT-2020-9829

Name of the Vulnerable Software and Affected Versions ConnectWise Control versions 19.3.25270.7185 Description An issue was discovered that allows Cross-Site Request Forgery CSRF to be used to send API requests. Recommendations For version 19.3.25270.7185, at the moment, there is no information...

PT-2020-9832

Name of the Vulnerable Software and Affected Versions ConnectWise Control versions 19.3.25270.7185 Description An issue was discovered that allows an unauthenticated attacker to determine with certainty if an account exists for a given username, due to a user enumeration vulnerability...

PT-2020-9830

Name of the Vulnerable Software and Affected Versions ConnectWise Control versions 19.3.25270.7185 Description An issue in ConnectWise Control allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by...

CVE-2019-16515: Undefined Security Weakness

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. Certain HTTP security headers are not used...

CVE-2019-16516: Observable Discrepancy

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username...

CVE-2019-16517: Origin Validation Error

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative...

CVE-2019-16514: Unrestricted Upload of File with Dangerous Type

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server...

CVE-2019-16512: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. There is stored XSS in the Appearance modifier...

CVE-2019-16513: Cross-Site Request Forgery (CSRF)

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. CSRF can be used to send API requests...