Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41 results
Sep 8, 2026ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityCVE-2026-84869 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49ExploitedCritical 9.9
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
- Product
- ScreenConnect
- On CISA’s list since
- Sep 11, 2026 (federal fix deadline Sep 14, 2026)
- What to do
- Attackers are using this now. Install ConnectWise’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comconnectwise.com
Jul 2, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology InteCVE-2026-13374 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 4.8
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Jun 10, 2026In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creationCVE-2026-11596 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Medium 4.7
In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.
- Product
- ScreenConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations.CVE-2026-9089 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 8.8
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-CVE-2026-6066 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 7.1
ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthCVE-2026-3564 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Critical 9
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
- Product
- ScreenConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute.CVE-2026-0696 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Medium 6.5
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
- Product
- PSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconnectwise.comthemissinglink.com.au
Jan 16, 2026In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certainCVE-2026-0695 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 8.7
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.
- Product
- PSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconnectwise.comthemissinglink.com.au
Dec 18, 2025In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returneCVE-2025-14823 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Medium 5.3
In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored at rest; however, an encrypted representation could be exposed in client responses. Updating the Certificate Signing Extension to version 1.0.12 or higher ensures configuration handling occurs exclusively on the server side, preventing encrypted values from being transmitted to or rendered by client-side components.
- Product
- ScreenConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and executiCVE-2025-14265 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Critical 9.1
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.
- Product
- ScreenConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology InteCVE-2025-13937 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 4.8
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Oct 16, 2025The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations.CVE-2025-11493 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 8.8
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS.CVE-2025-11492 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Critical 9.6
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2025In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information.CVE-2025-7204 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Medium 6.5
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users could then retrieve these hashes. An attacker or privileged user could then use these exposed hashes to conduct offline brute-force or dictionary attacks. Such attacks could lead to credential compromise, allowing unauthorized access to accounts, and potentially privilege escalation within the system.
- Product
- PSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconnectwise.comthemissinglink.com.au
May 19, 2025ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering.CVE-2025-4876 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Medium 6
ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning.
- Product
- Risk Assessment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025ConnectWise ScreenConnect Improper Authentication VulnerabilityCVE-2025-3935 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49ExploitedHigh 8.1
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.
- Product
- ScreenConnect
- On CISA’s list since
- Jun 2, 2025 (federal fix deadline Jun 23, 2025)
- What to do
- Attackers are using this now. Install ConnectWise’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogconnectwise.comconnectwise.com
Feb 21, 2024ConnectWise ScreenConnect Authentication Bypass VulnerabilityCVE-2024-1709 · Other software · ConnectWise · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedRansomwareCritical 10
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
- Product
- ScreenConnect
- On CISA’s list since
- Feb 22, 2024 (federal fix deadline Feb 29, 2024)
- What to do
- Attackers are using this now. Install ConnectWise’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Feb 21, 2024ConnectWise ScreenConnect Path Traversal VulnerabilityCVE-2024-1708 · Other software · ConnectWise · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedRansomwareHigh 8.4
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
- Product
- ScreenConnect
- On CISA’s list since
- Apr 28, 2026 (federal fix deadline May 12, 2026)
- What to do
- Attackers are using this now. Install ConnectWise’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogconnectwise.comhuntress.com
Feb 1, 2024ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.CVE-2023-47257 · Other software · Connectwise · reported by MITREHigh 8.1
ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgconnectwise.com
Feb 1, 2024ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settingsCVE-2023-47256 · Other software · Connectwise · reported by MITREMedium 5.5
ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgconnectwise.com
Feb 13, 2023ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exeCVE-2023-25719 · Other software · Connectwise · reported by MITREHigh 8.8
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations).
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybir.comm.youtube.com
Feb 13, 2023In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without inCVE-2023-25718 · Other software · Connectwise · reported by MITRECritical 9.8
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybir.comm.youtube.com
Feb 1, 2023Connectwise Automate 2022.11 is vulnerable to Cleartext authentication.CVE-2023-23130 · Other software · Connectwise · reported by MITREMedium 5.9
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS).CVE-2023-23128 · Other software · Connectwise · reported by MITREMedium 6.1
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid.
- Product
- Connectwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS.CVE-2023-23127 · Other software · Connectwise · reported by MITREMedium 5.3
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
- Product
- Connectwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Connectwise Automate 2022.11 is vulnerable to Clickjacking.CVE-2023-23126 · Other software · Connectwise · reported by MITREMedium 6.1
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limitinCVE-2022-36781 · Other software · ConnectWise · reported by cna@cyber.gov.ilMedium 5.3
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.
- Product
- ScreenConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.CVE-2021-35066 · Other software · Connectwise · reported by MITRECritical 9.8
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhome.connectwise.comconnectwise.com
Jun 17, 2021An issue was discovered in ConnectWise Automate before 2021.5.CVE-2021-32582 · Other software · Connectwise · reported by MITREHigh 7.5
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses.
- Product
- Connectwise Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhome.connectwise.comconnectwise.com
Oct 9, 2020The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.CVE-2020-15838 · Other software · Connectwise · reported by MITREHigh 8.8
The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbeta.comconnectwise.com
Jul 16, 2020ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts.CVE-2020-15027 · Other software · Connectwise · reported by MITRECritical 9.8
ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This was patched in 2020.7 and in a hotfix for 2019.12.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslagle.techslagle.tech
Jul 7, 2020A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12.CVE-2020-15008 · Other software · Connectwise · reported by MITREHigh 7.5
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.
- Product
- Connectwise Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslagle.techslagle.tech
Jun 15, 2020By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individualCVE-2020-14159 · Other software · Connectwise · reported by MITREHigh 8.8
By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.
- Product
- Automate API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconnectwise.comconnectwise.com
Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.CVE-2019-16517 · Other software · Connectwise · reported by MITRECritical 9.8
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.huntresslabs.comknow.bishopfox.com
Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.CVE-2019-16516 · Other software · Connectwise · reported by MITREMedium 5.3
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.huntresslabs.com
Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.CVE-2019-16515 · Other software · Connectwise · reported by MITREMedium 6.5
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.huntresslabs.comknow.bishopfox.com
Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.CVE-2019-16514 · Other software · Connectwise · reported by MITREHigh 7.2
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.huntresslabs.comknow.bishopfox.com
Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.CVE-2019-16513 · Other software · Connectwise · reported by MITREHigh 8.8
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.huntresslabs.comknow.bishopfox.com
Jan 23, 2020An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.CVE-2019-16512 · Other software · Connectwise · reported by MITREMedium 4.8
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.huntresslabs.comknow.bishopfox.com
Jul 31, 2017services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involving a ContactCommon CVE-2017-11727 · Other software · Connectwise · reported by MITREMedium 6.1
services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involving a ContactCommon field) on victims who click on a crafted link, aka XSS.
- Product
- Manage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbecomepentester.blogspot.inbecomepentester.blogspot.in
Jul 31, 2017services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an CVE-2017-11726 · Other software · Connectwise · reported by MITREHigh 8.8
services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an e-mail address setting.
- Product
- Manage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbecomepentester.blogspot.inbecomepentester.blogspot.in
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.