deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42089
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl-asoc-card: set priv->pdev before using it

priv->pdev pointer was set after being used in
fsl_asoc_card_audmux_init().
Move this assignment at the start of the probe function, so
sub-functions can correctly use pdev through priv.

fsl_asoc_card_audmux_init() dereferences priv->pdev to get access to the
dev struct, used with dev_err macros.
As priv is zero-initialised, there would be a NULL pointer dereference.
Note that if priv->dev is dereferenced before assignment but never used,
for example if there is no error to be printed, the driver won't crash
probably due to compiler optimisations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/29bc9e7c75398b0d12fc30955f2e9b2dd29ffaed; https://git.kernel.org/stable/c/3662eb2170e59b58ad479982dc1084889ba757b9; https://git.kernel.org/stable/c/544ab46b7ece6d6bebbdee5d5659c0a0f804a99a
CVE: CVE-2024-42090
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER

In create_pinctrl(), pinctrl_maps_mutex is acquired before calling
add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl()
calls pinctrl_free(). However, pinctrl_free() attempts to acquire
pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to
a potential deadlock.

This patch resolves the issue by releasing pinctrl_maps_mutex before
calling pinctrl_free(), preventing the deadlock.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/01fe2f885f7813f8aed5d3704b384a97b1116a9e; https://git.kernel.org/stable/c/4038c57bf61631219b31f1bd6e92106ec7f084dc; https://git.kernel.org/stable/c/420ce1261907e5dbeda1e4daffd5b6c76f8188c0
CVE: CVE-2024-6748
Published: 2024-07-29
Description: Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/itom/advisory/cve-2024-6748.html; https://www.manageengine.com/itom/advisory/cve-2024-6748.html
CVE: CVE-2024-42091
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Check pat.ops before dumping PAT settings

We may leave pat.ops unset when running on brand new platform or
when running as a VF.  While the former is unlikely, the latter
is valid (future) use case and will cause NPD when someone will
try to dump PAT settings by debugfs.

It's better to check pointer to pat.ops instead of specific .dump
hook, as we have this hook always defined for every .ops variant.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/583ce246c7ff9edeb0de49130cdc3d45db8545cb; https://git.kernel.org/stable/c/a918e771e6fbe1fa68932af5b0cdf473e23090cc; https://git.kernel.org/stable/c/583ce246c7ff9edeb0de49130cdc3d45db8545cb
CVE: CVE-2024-42092
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

gpio: davinci: Validate the obtained number of IRQs

Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken
DT due to any error this value can be any. Without this value validation
there can be out of chips->irqs array boundaries access in
davinci_gpio_probe().

Validate the obtained nirq value so that it won't exceed the maximum
number of IRQs per bank.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/2d83492259ad746b655f196cd5d1be4b3d0a3782; https://git.kernel.org/stable/c/70b48899f3f23f98a52c5b1060aefbdc7ba7957b; https://git.kernel.org/stable/c/7aa9b96e9a73e4ec1771492d0527bd5fc5ef9164
CVE: CVE-2024-42093
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net/dpaa2: Avoid explicit cpumask var allocation on stack

For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask
variable on stack is not recommended since it can cause potential stack
overflow.

Instead, kernel code should always use *cpumask_var API(s) to allocate
cpumask var in config-neutral way, leaving allocation strategy to
CONFIG_CPUMASK_OFFSTACK.

Use *cpumask_var API(s) to address it.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0; https://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527; https://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2
CVE: CVE-2024-42094
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net/iucv: Avoid explicit cpumask var allocation on stack

For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask
variable on stack is not recommended since it can cause potential stack
overflow.

Instead, kernel code should always use *cpumask_var API(s) to allocate
cpumask var in config-neutral way, leaving allocation strategy to
CONFIG_CPUMASK_OFFSTACK.

Use *cpumask_var API(s) to address it.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/0af718a690acc089aa1bbb95a93df833d864ef53; https://git.kernel.org/stable/c/2b085521be[PII_REDACTED]b5e7ca81b26be3f7098d; https://git.kernel.org/stable/c/2d090c7f7be3b26fcb80ac04d08a4a8062b1d959
CVE: CVE-2024-42095
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_omap: Implementation of Errata i2310

As per Errata i2310[0], Erroneous timeout can be triggered,
if this Erroneous interrupt is not cleared then it may leads
to storm of interrupts, therefore apply Errata i2310 solution.

[0] https://www.ti.com/lit/pdf/sprz536 page 23
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6270051f656004ca5cde644c73cb1fa4d718792e; https://git.kernel.org/stable/c/87257a28271c828a98f762bf2dd803c1793d2b5b; https://git.kernel.org/stable/c/98840e410d53329f5331ecdce095e740791963d0
CVE: CVE-2024-42096
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

x86: stop playing stack games in profile_pc()

The 'profile_pc()' function is used for timer-based profiling, which
isn't really all that relevant any more to begin with, but it also ends
up making assumptions based on the stack layout that aren't necessarily
valid.

Basically, the code tries to account the time spent in spinlocks to the
caller rather than the spinlock, and while I support that as a concept,
it's not worth the code complexity or the KASAN warnings when no serious
profiling is done using timers anyway these days.

And the code really does depend on stack layout that is only true in the
simplest of cases.  We've lost the comment at some point (I think when
the 32-bit and 64-bit code was unified), but it used to say:

	Assume the lock function has either no stack frame or a copy
	of eflags from PUSHF.

which explains why it just blindly loads a word or two straight off the
stack pointer and then takes a minimal look at the values to just check
if they might be eflags or the return pc:

	Eflags always has bits 22 and up cleared unlike kernel addresses

but that basic stack layout assumption assumes that there isn't any lock
debugging etc going on that would complicate the code and cause a stack
frame.

It causes KASAN unhappiness reported for years by syzkaller [1] and
others [2].

With no real practical reason for this any more, just remove the code.

Just for historical interest, here's some background commits relating to
this code from 2006:

  0cb91a229364 ("i386: Account spinlocks to the caller during profiling for !FP kernels")
  31679f38d886 ("Simplify profile_pc on x86-64")

and a code unification from 2009:

  ef4512882dbe ("x86: time_32/64.c unify profile_pc")

but the basics of this thing actually goes back to before the git tree.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/093d9603b60093a9aaae942db56107f6432a5dca; https://git.kernel.org/stable/c/161cef818545ecf980f0e2ebaf8ba7326ce53c2b; https://git.kernel.org/stable/c/16222beb9f8e5ceb0beeb5cbe54bef16df501a92
CVE: CVE-2024-42097
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: emux: improve patch ioctl data validation

In load_data(), make the validation of and skipping over the main info
block match that in load_guspatch().

In load_guspatch(), add checking that the specified patch length matches
the actually supplied data, like load_data() already did.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/40d7def67841343c10f8642a41031fecbb248bab; https://git.kernel.org/stable/c/79d9a000f0220cdaba1682d2a23c0d0c61d620a3; https://git.kernel.org/stable/c/7a18293fd8d8519c2f7a03753bc1583b18e3db69
CVE: CVE-2024-42098
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: ecdh - explicitly zeroize private_key

private_key is overwritten with the key parameter passed in by the
caller (if present), or alternatively a newly generated private key.
However, it is possible that the caller provides a key (or the newly
generated key) which is shorter than the previous key. In that
scenario, some key material from the previous key would not be
overwritten. The easiest solution is to explicitly zeroize the entire
private_key array first.

Note that this patch slightly changes the behavior of this function:
previously, if the ecc_gen_privkey failed, the old private_key would
remain. Now, the private_key is always zeroized. This behavior is
consistent with the case where params.key is set and ecc_is_key_valid
fails.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/39173b04abda87872b43c331468a4a14f8f05ce8; https://git.kernel.org/stable/c/73e5984e540a76a2ee1868b91590c922da8c24c9; https://git.kernel.org/stable/c/80575b252ab0358b7e93895b2a510beb3cb3f975
CVE: CVE-2024-6726
Published: 2024-07-29
Description: Versions of Delphix Engine prior to Release 25.0.0.0 contain a flaw which results in Remote Code Execution (RCE).
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://portal.perforce.com/s/detail/a91PA000001SUDtYAO; https://portal.perforce.com/s/detail/a91PA000001SUDtYAO
CVE: CVE-2024-6727
Published: 2024-07-29
Description: A flaw in versions of Delphix Data Control Tower (DCT) prior to 19.0.0 results in broken authentication through the enable-scale-testing functionality of the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://portal.perforce.com/s/detail/a91PA000001SUFVYA4; https://portal.perforce.com/s/detail/a91PA000001SUFVYA4
CVE: CVE-2024-28804
Published: 2024-07-29
Description: An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting (XSS) can occur via POST.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-28805
Published: 2024-07-29
Description: An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. There is Incorrect Access Control.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-28806
Published: 2024-07-29
Description: An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Remote unauthenticated attackers can upload files at an arbitrary path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-36
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-37856
Published: 2024-07-29
Description: Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, middle name fields in the User Profile page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://lost.com; https://packetstormsecurity.com/files/179078/Lost-And-Found-Information-System-1.0-Cross-Site-Scripting.html; https://www.sourcecodester.com/
CVE: CVE-2024-37857
Published: 2024-07-29
Description: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php-lfis/admin/categories/view_category.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://lost.com; https://packetstormsecurity.com/files/179080/Lost-And-Found-Information-System-1.0-SQL-Injection.html; https://www.sourcecodester.com/
CVE: CVE-2024-37858
Published: 2024-07-29
Description: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-269
References: http://lost.com; https://packetstormsecurity.com/files/179079/Lost-And-Found-Information-System-1.0-SQL-Injection.html; https://www.sourcecodester.com/
CVE: CVE-2024-37859
Published: 2024-07-29
Description: Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lost.com; https://packetstormsecurity.com/files/179081/Lost-And-Found-Information-System-1.0-Cross-Site-Scripting.html; https://www.sourcecodester.com/
CVE: CVE-2024-6578
Published: 2024-07-29
Description: A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680; https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680
CVE: CVE-2019-19759
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2019-19760
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2019-19761
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-48185
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-4038
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-6620
Published: 2024-07-29
Description: Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. A(n) attacker could potentially inject malicious code which may lead to information disclosure, session theft, or client-side request forgery. Honeywell recommends updating to the most recent version of this firmware, PC42 Printer Firmware Version 20.6 T10.20.060398.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-602
References: https://sps.honeywell.com/us/en/support/productivity/cyber-security-notifications; https://sps.honeywell.com/us/en/support/productivity/cyber-security-notifications
CVE: CVE-2017-3755
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2017-3766
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2017-3769
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2019-6162
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2019-6164
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2019-6174
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2019-6185
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-40396
Published: 2024-07-29
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://support.apple.com/en-us/HT213936; https://support.apple.com/en-us/HT213937; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-40398
Published: 2024-07-29
Description: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.4, macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 8.8 (HIGH)
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213675; https://support.apple.com/en-us/HT213676
CVE: CVE-2023-42918
Published: 2024-07-29
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-693
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940
CVE: CVE-2023-42925
Published: 2024-07-29
Description: The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access Notes attachments.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-42943
Published: 2024-07-29
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940
CVE: CVE-2023-42948
Published: 2024-07-29
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14. A Wi-Fi password may not be deleted when activating a Mac in macOS Recovery.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940
CVE: CVE-2023-42949
Published: 2024-07-29
Description: This issue was addressed with improved data protection. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able to access edited photos saved to a temporary directory.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/HT213936; https://support.apple.com/en-us/HT213937; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-42957
Published: 2024-07-29
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10. An app may be able to read sensitive location information.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://support.apple.com/en-us/HT213937; https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940
CVE: CVE-2023-42958
Published: 2024-07-29
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.4. An app may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213758
CVE: CVE-2023-42959
Published: 2024-07-29
Description: A race condition was addressed with improved state handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940
CVE: CVE-2024-3219
Published: 2024-07-29
Description: The
 “socket” module provides a pure-Python fallback to the 
socket.socketpair() function for platforms that don’t support AF_UNIX, 
such as Windows. This pure-Python implementation uses AF_INET or 
AF_INET6 to create a local connected pair of sockets. The connection 
between the two sockets was not verified before passing the two sockets 
back to the user, which leaves the server socket vulnerable to a 
connection race from a malicious local peer.

Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.
CWE: CWE-306
References: http://www.openwall.com/lists/oss-security/2024/07/29/3; https://github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20; https://github.com/python/cpython/commit/0b65c8bf[PII_REDACTED]eafb92f85046a1b31259f2
CVE: CVE-2024-7248
Published: 2024-07-29
Description: Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the update mechanism. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-19055.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-24-953/; https://www.zerodayinitiative.com/advisories/ZDI-24-953/
CVE: CVE-2024-7249
Published: 2024-07-29
Description: Comodo Firewall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the application to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21794.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-24-954/; https://www.zerodayinitiative.com/advisories/ZDI-24-954/
CVE: CVE-2024-7250
Published: 2024-07-29
Description: Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22829.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-24-955/; https://www.zerodayinitiative.com/advisories/ZDI-24-955/