deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-36413
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-ph2c-hvvf-r273; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-ph2c-hvvf-r273
CVE: CVE-2024-36414
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors file verification allows for a server-side request forgery attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-wg74-772c-8gr7; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-wg74-772c-8gr7
CVE: CVE-2024-36415
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-98, CWE-434, CWE-434
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-c82f-58jv-jfrh; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-c82f-58jv-jfrh
CVE: CVE-2024-36416
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-779
References: https://docs.suitecrm.com/admin/releases/7.14.x/; https://github.com/kva55/CVE-2024-36416; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-jrpp-22g3-2j77
CVE: CVE-2024-36417
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-3www-6rqc-rm7j; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-3www-6rqc-rm7j
CVE: CVE-2024-37014
Published: 2024-06-10
Description: Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/langflow-ai/langflow/issues/1973; https://github.com/langflow-ai/langflow/issues/1973
CVE: CVE-2024-37393
Published: 2024-06-10
Description: Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-89
References: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22; https://securenvoy.com/support/; https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393
CVE: CVE-2024-23251
Published: 2024-06-10
Description: An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. An attacker with physical access may be able to leak Mail account credentials.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120902; https://support.apple.com/en-us/120903
CVE: CVE-2024-23282
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A maliciously crafted email may be able to initiate FaceTime calls without user authorization.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120902; https://support.apple.com/en-us/120903
CVE: CVE-2024-27799
Published: 2024-06-10
Description: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An unprivileged app may be able to log keystrokes in other apps including those using secure input mode.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27800
Published: 2024-06-10
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a maliciously crafted message may lead to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27801
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902; https://support.apple.com/en-us/120903
CVE: CVE-2024-27802
Published: 2024-06-10
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27805
Published: 2024-06-10
Description: An issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27806
Published: 2024-06-10
Description: This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27807
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5. An app may be able to circumvent App Privacy Report logging.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120905; https://support.apple.com/en-us/HT214100
CVE: CVE-2024-27808
Published: 2024-06-10
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-786
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902
CVE: CVE-2024-27811
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902; https://support.apple.com/en-us/120903
CVE: CVE-2024-27812
Published: 2024-06-10
Description: A logic issue was addressed with improved file handling. This issue is fixed in visionOS 1.2. Processing web content may lead to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/120906; http://seclists.org/fulldisclosure/2024/Jun/5; https://support.apple.com/en-us/HT214108
CVE: CVE-2024-27814
Published: 2024-06-10
Description: This issue was addressed through improved state management. This issue is fixed in watchOS 10.5. A person with physical access to a device may be able to view contact information from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/120902; https://support.apple.com/en-us/HT214104; https://support.apple.com/kb/HT214104
CVE: CVE-2024-27815
Published: 2024-06-10
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902; https://support.apple.com/en-us/120903
CVE: CVE-2024-27817
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-353
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27819
Published: 2024-06-10
Description: The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-284
References: https://support.apple.com/en-us/120905; https://support.apple.com/en-us/HT214101; https://support.apple.com/kb/HT214101
CVE: CVE-2024-27820
Published: 2024-06-10
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120901
CVE: CVE-2024-27828
Published: 2024-06-10
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-786, CWE-788
References: https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902; https://support.apple.com/en-us/120905
CVE: CVE-2024-27830
Published: 2024-06-10
Description: This issue was addressed through improved state management. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902
CVE: CVE-2024-27831
Published: 2024-06-10
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. Processing a file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-786
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27832
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-703
References: https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902; https://support.apple.com/en-us/120903
CVE: CVE-2024-27833
Published: 2024-06-10
Description: An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120901
CVE: CVE-2024-27836
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, visionOS 1.2. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/120903; https://support.apple.com/en-us/120905; https://support.apple.com/en-us/120906
CVE: CVE-2024-27838
Published: 2024-06-10
Description: The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120901
CVE: CVE-2024-27840
Published: 2024-06-10
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. An attacker that has already achieved kernel code execution may be able to bypass kernel memory protections.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-786
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-27844
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in Safari 17.5, macOS Sonoma 14.5, visionOS 1.2. A website's permission dialog may persist after navigation away from the site.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120903; https://support.apple.com/en-us/120906
CVE: CVE-2024-27845
Published: 2024-06-10
Description: A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.5 and iPadOS 17.5. An app may be able to access Notes attachments.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/120905; https://support.apple.com/en-us/HT214101; https://support.apple.com/kb/HT214101
CVE: CVE-2024-27848
Published: 2024-06-10
Description: This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863, CWE-277
References: https://support.apple.com/en-us/120903; https://support.apple.com/en-us/120905; https://support.apple.com/en-us/HT214101
CVE: CVE-2024-27850
Published: 2024-06-10
Description: This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, visionOS 1.2. A maliciously crafted webpage may be able to fingerprint the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-359
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120903; https://support.apple.com/en-us/120905
CVE: CVE-2024-27851
Published: 2024-06-10
Description: The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120902
CVE: CVE-2024-27855
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. A shortcut may be able to use sensitive data with certain actions without prompting the user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120900; https://support.apple.com/en-us/120903
CVE: CVE-2024-27857
Published: 2024-06-10
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-94
References: https://support.apple.com/en-us/120901; https://support.apple.com/en-us/120903; https://support.apple.com/en-us/120905
CVE: CVE-2024-27885
Published: 2024-06-10
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to modify protected parts of the file system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900; https://support.apple.com/en-us/120903
CVE: CVE-2024-33850
Published: 2024-06-10
Description: Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roster list, and perform certain actions that should not be allowed before they are admitted to the meeting.
CVSS Score: 4.3 (MEDIUM)
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2024-36418
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-mfj5-37v4-vh5w; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-mfj5-37v4-vh5w
CVE: CVE-2024-32849
Published: 2024-06-10
Description: Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://helpcenter.trendmicro.com/en-us/article/tmka-19175; https://www.zerodayinitiative.com/advisories/ZDI-24-576/; https://helpcenter.trendmicro.com/en-us/article/tmka-19175
CVE: CVE-2024-35241
Published: 2024-06-10
Description: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4; https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704; https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
CVE: CVE-2024-35242
Published: 2024-06-10
Description: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396; https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467; https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf
CVE: CVE-2024-36302
Published: 2024-06-10
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2024-36303.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000298063; https://www.zerodayinitiative.com/advisories/ZDI-24-569/; https://success.trendmicro.com/dcx/s/solution/000298063
CVE: CVE-2024-36303
Published: 2024-06-10
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2024-36302.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000298063; https://www.zerodayinitiative.com/advisories/ZDI-24-570/; https://success.trendmicro.com/dcx/s/solution/000298063
CVE: CVE-2024-36304
Published: 2024-06-10
Description: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://success.trendmicro.com/dcx/s/solution/000298063; https://www.zerodayinitiative.com/advisories/ZDI-24-571/; https://success.trendmicro.com/dcx/s/solution/000298063