Unscored severity · published Nov 16, 2005
CVE-2005-3560
Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 through 6.1, and (5) ZoneAlarm 6.0 allow…
–
CVSS
15.5%
EPSS
No
On KEV
Description
Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 through 6.1, and (5) ZoneAlarm 6.0 allow remote attackers to bypass the "Advanced Program Control and OS Firewall filters" setting via URLs in "HTML Modal Dialogs" (window.location.href) contained within JavaScript tags.
Exploitation
Is it being used?
Exploit prediction (EPSS)15.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
Zonealarm · Zonelabs
6.0; 6.0 · source: NVD
ZA
Zonealarm Anti-spyware · Zonelabs
6.0; 6.1 · source: NVD
ZA
Zonealarm Antivirus · Zonelabs
6.0 · source: NVD
ZS
Zonealarm Security Suite · Zonelabs
6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3560
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3560
Vendor Advisory
http://secunia.com/advisories/17450
securityreason.com
http://securityreason.com/securityalert/155
www.osvdb.org
http://www.osvdb.org/20677
www.securityfocus.com
http://www.securityfocus.com/archive/1/415968
Exploit
http://www.securityfocus.com/bid/15347
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/22971
More from Zonealarm
5.5
CVE-2001-0682
ZoneAlarm and ZoneAlarm Pro allows a local attacker to cause a denial of service by running a trojan to initialize a ZoneAlarm mutex object which prevents ZoneAlarm from starting
–
CVE-2007-5044
ZoneAlarm Pro 7.0.362.000 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of…
–
CVE-2007-2467
ZoneAlarm Pro 6.5.737.000, 6.1.744.001, and possibly earlier versions and other products, allows local users to cause a denial of service (system crash) by sending malformed data…
–
CVE-2007-2083
vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local…
–
CVE-2007-0351
Microsoft Windows XP and Windows Server 2003 do not properly handle user logoff, which might allow local users to gain the privileges of a previous system user, possibly related…