557 matches found
CVE-2023-41717
CVE-2023-41717 Control inadecuado de tipos de archivo en Zscaler Proxy versiones 3.6.1.25 y anteriores permite a atacantes locales eludir las restricciones de descarga/carga de archivos. Resumen Ejecutivo Durante el verano de 2022, encontré una vulnerabilidad que afecta al proxy ZScaler versiones...
tools
Herramientas de Zscaler ThreatLabz Herramientas desarrolladas por el equipo de Inteligencia de Amenazas de Zscaler ThreatLabz Síguenos en Twitter: @Threatlabz Blog: https://www.zscaler.com/blogs/security-research...
iocs
Zscaler ThreatLabz IOCs Este repositorio contiene Indicadores de Compromiso IOCs del equipo Zscaler ThreatLabz. Síguenos en Twitter: @Threatlabz Blog: https://www.zscaler.com/blogs/security-research...
bug-bounty-reports-desai-vinayak
🧩 Bug Bounty 报告 — Desai Vinayak 🔒 由 Desai Vinayak 编写的漏洞赏金和漏洞研究报告。 本仓库收集了用于协调披露 和修复跟踪 的被动、非破坏性 漏洞报告及辅助证据。 📁 目录 📂 reports/ — 每份报告的 PDF、DOCX 和证据文件： 🧠 BugBountyReportDesaiVinayakCVE-2023-50290.pdf — Apache Solr Metrics API 信息泄露（CVE-2023-50290 ）。 🌐 zscalerbugbountyreport.pdf — 针对选定的 zscaler.com...
CVE-2026-59563
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
EUVD-2026-88244
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563
The Zscaler MCP Server versions 0.7.0 and 0.7.1 are vulnerable to a token replay issue. The root cause is that HMAC confirmation tokens are not bound to the target resource identifier. This allows an MCP client or agent to replay a token intended for one resource to impact another resource of the...
CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563: Authentication Bypass by Primary Weakness
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-25684
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-25684 File Type Control rule bypass
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-25684 File Type Control rule bypass
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-25684
CVE-2026-25684 identifies a file type attribution issue in Zscaler Internet Access File Type Control evaluation rules. This may allow improper evaluation of File Type Control policies in rare circumstances, where a file's type is incorrectly attributed, potentially causing policy rules to be bypa...
EUVD-2026-82928
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-25684: Improper Input Validation
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-59570
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
CVE-2026-59569
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
CVE-2026-25687
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...