472 matches found
CVE-2023-28807 Bypass of ZIA domain fronting detection module through evasion technique
In Zscaler Internet Access ZIA a mismatch between Connect Host and Client Hello's Server Name Indication SNI enables attackers to evade network security controls by hiding their communications within legitimate traffic...
CVE-2023-28807
CVE-2023-28807 affects Zscaler Internet Access (ZIA). A mismatch between Connect Host and Client Hello’s Server Name Indication (SNI) can allow an attacker to hide communications within legitimate traffic, enabling evasion of network security controls. The CVE’s NVD entry notes a network attack v...
Zscaler Internet Access 安全漏洞
Zscaler Internet Access is a cloud-native Security Service Edge SSE solution from Zscaler. Zscaler Internet Access suffers from a security vulnerability that stems from a mismatch between server name indications, which allows an attacker to hide their communications from legitimate traffic to eva...
Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
This is the third part of our study about the Common Log File System CLFS and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you havent already. You can skip to the other parts using this tab...
QakBot Malware Resurfaces with New Tactics, Targeting the Hospitality Industry
A new wave of phishing messages distributing the QakBot malware has been observed, more than three months after a law enforcement effort saw its infrastructure dismantled by infiltrating its command-and-control C2 network. Microsoft, which made the discovery, described it as a low-volume campaign...
CVE-2023-28802
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...
CVE-2023-28802
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...
Input validation
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...
CVE-2023-28802 Disable Zscaler using machine tunnel restart
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...
CVE-2023-28802
Zscaler Client Connector for Windows is affected by CVE-2023-28802 due to improper validation of integrity check values. An authenticated user can disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. Affected versions are prior to 4.2.0.149. Remediation: upgrade to 4.2.0....
CVE-2023-28802 Disable Zscaler using machine tunnel restart
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...
PT-2023-21978
Name of the Vulnerable Software and Affected Versions Zscaler Client Connector versions prior to 4.2.0.149 Description An issue with improper validation of integrity check values in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service...
Zscaler Client Connector Security Vulnerability
Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A security...
MAL-2023-8487 Malicious code in @zscaler/api-enums (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c39d52170e43f12fe7201b08e2de04584d74da45150b565ffc66b523ef4d9b73 The OpenSSF Package Analysis project identified '@zscaler/api-enums' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in @zscaler/api-enums (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c39d52170e43f12fe7201b08e2de04584d74da45150b565ffc66b523ef4d9b73 The OpenSSF Package Analysis project identified '@zscaler/api-enums' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2023-8486 Malicious code in @zscaler/ec-domain (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31bceaac08bb6d621ea722590b8ba815799a6af81cc537fa0796ea7983b0f1d2 The OpenSSF Package Analysis project identified '@zscaler/ec-domain' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
Malicious code in @zscaler/ec-domain (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31bceaac08bb6d621ea722590b8ba815799a6af81cc537fa0796ea7983b0f1d2 The OpenSSF Package Analysis project identified '@zscaler/ec-domain' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
CVE-2023-28794
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...
CVE-2023-28794
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...
Input validation
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...