MAL-2023-8486 Malicious code in @zscaler/ec-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31bceaac08bb6d621ea722590b8ba815799a6af81cc537fa0796ea7983b0f1d2 The OpenSSF Package Analysis project identified '@zscaler/ec-domain' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in @zscaler/ec-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31bceaac08bb6d621ea722590b8ba815799a6af81cc537fa0796ea7983b0f1d2 The OpenSSF Package Analysis project identified '@zscaler/ec-domain' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

CVE-2023-28794

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28794

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

Input validation

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28794 PAC Files Exposed to Internet Websites

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28794

CVE-2023-28794 concerns an Origin Validation Error in Zscaler Client Connector for Linux prior to version 1.3.1.6 . Multiple connected sources (e.g., PT-2023-21970, RH, NVD, Red Hat, CNNVD mirrors) describe a vulnerability that could permit privilege abuse due to faulty origin validation. Affecte...

CVE-2023-28794 PAC Files Exposed to Internet Websites

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

Zscaler Client Connector Access Control Error Vulnerability

Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A security...

CVE-2023-28794: Origin Validation Error

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28797

Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user...

CVE-2021-26736

Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges...

CVE-2023-28804

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105...

CVE-2023-28805

An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105...

CVE-2021-26738

Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges...

CVE-2021-26736

Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges...

CVE-2023-28796

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28804

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105...

CVE-2023-28793

Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

CVE-2023-28803

An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9...