Zscaler vulnerabilities, page 3
58 vulnerabilities
Known vulnerabilities in Zscaler products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.
CVE-2023-41970zscalerclient_connector
EPSS score0.11%
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execution of Code.This issue affects Client Connector on Windows: before 4.1.0.62.CVE-2023-41717zscalerzscaler_proxyEPSS score0.38%
Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions.CVE-2023-41972zscalerclient_connectorEPSS score0.24%
In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later.CVE-2023-28800zscalerclient_connectorEPSS score0.55%
When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.CVE-2023-28801zscalerzia admin portal+1EPSS score0.39%
An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.CVE-2023-28798zscalerclient_connectorEPSS score0.43%
An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution.CVE-2023-28796zscalerclient_connectorEPSS score0.18%
Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.CVE-2023-28793zscalerclient_connectorEPSS score0.30%
Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.CVE-2023-28807zscalersecure_internet_and_saas_access+1EPSS score0.34%
In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.CVE-2023-28799zscalerclient_connectorEPSS score0.45%
A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.CVE-2023-28803zscalerclient_connectorEPSS score0.26%
An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.CVE-2023-28795zscalerclient_connectorEPSS score0.15%
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.CVE-2023-28805zscalerclient_connectorEPSS score0.35%
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105CVE-2023-28794zscalerclient_connectorEPSS score0.20%
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.CVE-2023-28797zscalerclient_connectorEPSS score0.22%
Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user.CVE-2023-28804zscalerclient_connectorEPSS score0.24%
An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105CVE-2023-28806zscalerclient_connectorEPSS score0.19%
An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190.CVE-2023-28802zscalerclient_connectorEPSS score0.23%
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149.