CVE-2019-16517

ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185 is affected by a CORS misconfiguration that reflects the Origin header, enabling JavaScript from any domain to interact with server APIs and perform administrative actions without user knowledge. Public sources in the connected document...

CVE-2019-16516

ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185 is affected by a user-enumeration vulnerability that allows an unauthenticated attacker to determine with certainty whether an account exists for a given username. This is documented in multiple sources (Red Hat CVE entry and related ad...

CVE-2023-25719

ConnectWise Control before 22.9.10032 is vulnerable due to failure to validate user-supplied parameters (notably the h parameter in Bin/ConnectWiseControl.Client.exe). This can lead to reflected data and injection of malicious code into a downloaded executable, enabling malicious queries or a den...

CVE-2019-16512

CVE-2019-16512 affects ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185, with a reported stored XSS in the Appearance modifier . The connected records confirm the issue but do not provide additional technical specifics beyond the vulnerability type and location. No explicit exploitati...

CVE-2019-16514

CVE-2019-16514 affects ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185. The server allows remote code execution: an unsigned extension ZIP uploaded by an administrative user can contain executable code that is then executed on the server. This is corroborated by NVD and Red Hat entri...

CVE-2023-25718

ConnectWise Control (through 22.9.10032) has a vulnerability where, after an executable is signed, additional instructions can be appended without invalidating the signature, potentially leading to an attacker-controlled executable being offered to the end user for download and execution. Connect...

CVE-2019-16513

ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185 is affected by a CSRF issue that can be used to send API requests without user authorization. The root cause is CSRF in the web/API surface, enabling potentially unauthorized actions via forged requests. Concrete impact is partial to hi...

CVE-2019-16515

CVE-2019-16515 affects ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185. The issue is that certain HTTP security headers are not used, with CVSS metrics indicating a network-exposed, low-complexity vulnerability (Base Score ~6.4–6.5) affecting confidentiality and integrity (PARTIAL) b...