Zscaler records

46 published records for vendor zscaler.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 5
With a fix record: 2.2%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

46 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2020-11633No exploit	The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers.zscaler · client connector · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	1.8%	Jul 15, 2021
39Monitor	CVE-2024-23483No exploit	Local Privilege Escalation via lack of input validationzscaler · client connector · CWE-20 pre-auth RCE Command injection	Critical9.8	—	0.7%	Aug 6, 2024
39Monitor	CVE-2024-23459No exploit	Multiple Arbitrary Creates/Overwrites by link followingzscaler · client connector · CWE-59 Pre-auth	Critical9.8	—	0.4%	May 2, 2024
39Monitor	CVE-2023-28798No exploit	Out-of-bounds write to heap in pacparserzscaler · client connector · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	0.4%	May 2, 2024
39Monitor	CVE-2023-28801No exploit	Improper SAML signature verificationzscaler · zscaler internet access admin portal · CWE-347 Pre-auth Weak crypto	Critical9.8	—	0.3%	Aug 31, 2023
39Monitor	CVE-2023-28805No exploit	ZCC on Linux privilege escalationzscaler · client connector · CWE-78 pre-auth RCE Command injection	Critical9.8	—	0.3%	Oct 23, 2023
39Monitor	CVE-2024-23480No exploit	Insecure MacOS code sign check fallbackzscaler · client connector · CWE-347 pre-auth RCE Weak crypto	Critical9.8	—	0.3%	May 1, 2024
32Monitor	CVE-2024-23463No exploit	Anti-Tampering bypass via Repair App functionalityzscaler · client connector · CWE-367 Pre-auth Race condition	High8.1	—	0.3%	Apr 30, 2024
31Monitor	CVE-2024-3661Proof of concept	DHCP routing options can manipulate interface-based VPN trafficfortinet · forticlient · CWE-306 Pre-auth Auth bypass	High7.6	—	4.0%	May 6, 2024
31Monitor	CVE-2020-11634No exploit	The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL.zscaler · client connector · CWE-427 RCE	High7.8	—	0.4%	Jul 15, 2021
31Monitor	CVE-2020-11635No exploit	The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with szscaler · client connector Local privilege escalation	High7.8	—	0.4%	Feb 16, 2021
31Monitor	CVE-2020-11632No exploit	The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code wzscaler · client connector · CWE-428 Local privilege escalation	High7.8	—	0.3%	Jul 15, 2021
31Monitor	CVE-2023-41973No exploit	Lack of input santization on Zscaler Client Connector enables arbitrary code executionzscaler · client connector · CWE-22 RCE Path traversal	High7.8	—	0.3%	Mar 26, 2024
31Monitor	CVE-2023-28793No exploit	Heap Based Buffer Overflow in Libraryzscaler · client connector · CWE-94 RCE	High7.8	—	0.3%	Oct 23, 2023
31Monitor	CVE-2024-23482No exploit	ZScalerService Local Privilege Escalationzscaler · client connector · CWE-20 Local privilege escalation	High7.8	—	0.2%	Mar 26, 2024
31Monitor	CVE-2023-41972No exploit	Revert password check incorrect type validationzscaler · client connector · CWE-280	High7.8	—	0.2%	Mar 26, 2024
31Monitor	CVE-2021-26738No exploit	Privilege Escalation for ZCC macOS via PATH Variablezscaler · client connector · CWE-426 Local privilege escalation	High7.8	—	0.2%	Oct 23, 2023
31Monitor	CVE-2021-26736No exploit	ZApp Installer Privilege Escalation Vulnerabilitieszscaler · client connector · CWE-20 Local privilege escalation	High7.8	—	0.2%	Oct 23, 2023
31Monitor	CVE-2024-23457No exploit	Anti-tampering can be disabled with uninstall password enforcedzscaler · client connector · CWE-269 Local privilege escalation	High7.8	—	0.2%	May 1, 2024
31Monitor	CVE-2023-41971No exploit	Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Controlzscaler · client connector · CWE-59 Local privilege escalation	High7.8	—	0.1%	May 2, 2024
31Monitor	CVE-2023-28796No exploit	IPC Bypass Through PLT Section in ELFzscaler · client connector · CWE-94 RCE	High7.8	—	0.1%	Oct 23, 2023
31Monitor	CVE-2023-28795No exploit	Client IPC validation bypasszscaler · client connector · CWE-346	High7.8	—	0.1%	Oct 23, 2023
31Monitor	CVE-2021-26735No exploit	Untrusted Search Path While Executing REG DELETE by Uninstallerzscaler · client connector · CWE-346 Local privilege escalation	High7.8	—	0.1%	Oct 23, 2023
31Monitor	CVE-2024-23460No exploit	Incorrect signature validation of packagezscaler · client connector · CWE-347 RCE Weak crypto	High7.8	—	0.1%	Aug 6, 2024
31Monitor	CVE-2024-23458No exploit	Local Privilege Escalation on Zscaler Client Connector on Windowszscaler · client connector · CWE-346 Local privilege escalation	High7.8	—	0.1%	Aug 6, 2024

CVE-2020-11633
40Plan
The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
zscaler · client connectorJul 15, 2021
CVE-2024-23483
39Monitor
Local Privilege Escalation via lack of input validation
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
zscaler · client connectorAug 6, 2024
CVE-2024-23459
39Monitor
Multiple Arbitrary Creates/Overwrites by link following
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
zscaler · client connectorMay 2, 2024
CVE-2023-28798
39Monitor
Out-of-bounds write to heap in pacparser
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
zscaler · client connectorMay 2, 2024
CVE-2023-28801
39Monitor
Improper SAML signature verification
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
zscaler · zscaler internet access admin portalAug 31, 2023
CVE-2023-28805
39Monitor
ZCC on Linux privilege escalation
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
zscaler · client connectorOct 23, 2023
CVE-2024-23480
39Monitor
Insecure MacOS code sign check fallback
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Weak crypto
zscaler · client connectorMay 1, 2024
CVE-2024-23463
32Monitor
Anti-Tampering bypass via Repair App functionality
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Race condition
zscaler · client connectorApr 30, 2024
CVE-2024-3661
31Monitor
DHCP routing options can manipulate interface-based VPN traffic
HighCVSS 7.6Proof of conceptEPSS 4%
- Pre-auth
- Auth bypass
fortinet · forticlientMay 6, 2024
CVE-2020-11634
31Monitor
The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL.
HighCVSS 7.8No exploitEPSS 0%
- RCE
zscaler · client connectorJul 15, 2021
CVE-2020-11635
31Monitor
The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with s
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorFeb 16, 2021
CVE-2020-11632
31Monitor
The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code w
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorJul 15, 2021
CVE-2023-41973
31Monitor
Lack of input santization on Zscaler Client Connector enables arbitrary code execution
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Path traversal
zscaler · client connectorMar 26, 2024
CVE-2023-28793
31Monitor
Heap Based Buffer Overflow in Library
HighCVSS 7.8No exploitEPSS 0%
- RCE
zscaler · client connectorOct 23, 2023
CVE-2024-23482
31Monitor
ZScalerService Local Privilege Escalation
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorMar 26, 2024
CVE-2023-41972
31Monitor
Revert password check incorrect type validation
HighCVSS 7.8No exploitEPSS 0%
zscaler · client connectorMar 26, 2024
CVE-2021-26738
31Monitor
Privilege Escalation for ZCC macOS via PATH Variable
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorOct 23, 2023
CVE-2021-26736
31Monitor
ZApp Installer Privilege Escalation Vulnerabilities
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorOct 23, 2023
CVE-2024-23457
31Monitor
Anti-tampering can be disabled with uninstall password enforced
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorMay 1, 2024
CVE-2023-41971
31Monitor
Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorMay 2, 2024
CVE-2023-28796
31Monitor
IPC Bypass Through PLT Section in ELF
HighCVSS 7.8No exploitEPSS 0%
- RCE
zscaler · client connectorOct 23, 2023
CVE-2023-28795
31Monitor
Client IPC validation bypass
HighCVSS 7.8No exploitEPSS 0%
zscaler · client connectorOct 23, 2023
CVE-2021-26735
31Monitor
Untrusted Search Path While Executing REG DELETE by Uninstaller
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorOct 23, 2023
CVE-2024-23460
31Monitor
Incorrect signature validation of package
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Weak crypto
zscaler · client connectorAug 6, 2024
CVE-2024-23458
31Monitor
Local Privilege Escalation on Zscaler Client Connector on Windows
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorAug 6, 2024