Zscaler Client Connector vulnerabilities
50 vulnerabilities
Known vulnerabilities in Zscaler Client Connector, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-26738zscalerclient_connector
EPSS score0.23%
Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.CVE-2021-26735zscalerclient_connectorEPSS score0.13%
The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.CVE-2021-26737zscalerclient_connectorEPSS score0.11%
The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.CVE-2021-26734zscalerclient_connectorEPSS score0.14%
Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context.CVE-2021-26736zscalerclient_connectorEPSS score0.22%
Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.CVE-2020-11635zscalerclient_connectorEPSS score0.44%
The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges.CVE-2020-11634zscalerclient_connectorEPSS score0.46%
The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.CVE-2020-11633zscalerclient_connectorEPSS score1.89%
The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges.CVE-2020-11632zscalerclient_connectorEPSS score0.32%
The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges.CVE-2024-31127zscalerclient_connectorEPSS score0.10%
An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges.CVE-2024-3661ciscoanyconnect_vpn_client+63EPSS score4.06%
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.CVE-2024-23459zscalerclient_connectorEPSS score0.47%
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This issue affects Zscaler Client Connector on Mac : before 3.7.CVE-2024-23482zscalerclient_connectorEPSS score0.27%
The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Fixed Version: Mac ZApp 4.2.0.241 and later.CVE-2024-23463zscalerclient_connectorEPSS score0.37%
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zscaler Client Connector on Windows prior to 4.2.1CVE-2024-23483zscalerclient_connectorEPSS score0.75%
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2.CVE-2024-23456zscalerclient_connectorEPSS score0.23%
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.CVE-2024-23461zscalerclient_connectorEPSS score0.11%
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.This issue affects Client Connector on MacOS: before 3.4.CVE-2024-23458zscalerclient_connectorEPSS score0.11%
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.CVE-2024-23460zscalerclient_connectorEPSS score0.13%
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.CVE-2024-23464zscalerclient_connectorEPSS score0.43%
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1