ConnectWise ScreenConnect any version

Authentication bypass using an alternate path or channel

ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

Improper server-side validation in ScreenConnect extension framework

Improper limitation of a pathname to a restricted directory (“path traversal”)

ScreenConnect Exposure to ASP.NET ViewState Code Injection

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings

ConnectWise - ScreenConnect Session Code Bypass

Certificate Signing Extension Returns Encrypted Values

In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.