Local Privilege Escalation via lack of input validation

Multiple Arbitrary Creates/Overwrites by link following

Out-of-bounds write to heap in pacparser

Insecure MacOS code sign check fallback

An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation

The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers

Remote Code Execution

Authentication bypass between ZCC and client connector portal

Local privilege escalation

Local and kernel denial-of-service

Local denial-of-service

Android ZCC VPN API method privilege escalation

ZCC race condition in ZPA tunnel handler

Anti-Tampering bypass via Repair App functionality

Incorrect signature validation of package

Local Privilege Escalation on Zscaler Client Connector on Windows

Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control

Repair App local code execution with arbitrary privileges

Anti-tampering can be disabled with uninstall password enforced

ZScalerService Local Privilege Escalation

Lack of input santization on Zscaler Client Connector enables arbitrary code execution

Revert password check incorrect type validation

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process

Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection

Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable

Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path

The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability

The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL

The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges

The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited…

DHCP routing options can manipulate interface-based VPN traffic

Android ZCC denial of service

Signature validation issue leads to Anti-Tampering bypass

ZCC Mac validinstaller file integrity check missing

MacOS Zscaler Client Connector Local Privilege Escalation

Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk

ZSATrayManager Arbitrary File Deletion

Signature validation error in DLL allows disabling anti-tampering protection

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse

An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login

A URL parameter during login flow was vulnerable to injection

ZCC macOS Upgrade ZIP Bomb DoS

Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from…

Incorrect startup configuration in ZCC

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before…

Zscaler bypass with administrative privileges on Windows

The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients