CVE-2020-15027
Published Jul 16, 2020ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This was patched in 2020.…
Vendor archive
connectwise CVEs
Beta · best-effort37 CVEs tagged to vendor connectwise — 8 Critical, 15 High, 14 Medium, 0 Low, 0 Unrated.
CVE-2020-15008
Published Jul 7, 2020A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists du…
CVE-2020-14159
Published Jun 15, 2020By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance…
CVE-2019-16517
Published Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming…
CVE-2019-16516
Published Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker t…
CVE-2019-16515
Published Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used.
CVE-2019-16514
Published Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an uns…
CVE-2019-16513
Published Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests.
CVE-2019-16512
Published Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier.
CVE-2017-18362
Published Feb 5, 2019ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In Feb…
- Buzz score
- 25.0
CVE-2017-11727
Published Jul 31, 2017services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involving a ContactCommon field) on victims w…
CVE-2017-11726
Published Jul 31, 2017services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an e-mail address sett…
Showing 26-37 of 37 CVEsPage 2 of 2