Filtered by vendor Connectwise
Subscribe
Total
27 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-14159 | 1 Connectwise | 1 Automate Api | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178. | |||||
| CVE-2019-16517 | 1 Connectwise | 1 Control | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge. | |||||
| CVE-2019-16516 | 1 Connectwise | 1 Control | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username. | |||||
| CVE-2019-16515 | 1 Connectwise | 1 Control | 2024-11-21 | 6.4 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used. | |||||
| CVE-2019-16514 | 1 Connectwise | 1 Control | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server. | |||||
| CVE-2019-16513 | 1 Connectwise | 1 Control | 2024-11-21 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests. | |||||
| CVE-2019-16512 | 1 Connectwise | 1 Control | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier. | |||||