Lays

يسمح خطأ في التحقق من مصدر البيانات ضمن آلية الاتصال الخاصة بحماية العمليات لمهاجم محلي بترقية امتيازاته. لاستغلال هذه الثغرة، يجب أن يتمتع المهاجم أولاً بالقدرة على تنفيذ تعليمات برمجية ذات امتيازات منخفضة على النظام المستهدف.

يسمح خطأ في التحقق من مصدر البيانات ضمن آلية حماية العمليات لمهاجم محلي بترقية امتيازاته. لاستغلال هذه الثغرة، يجب أن يتمتع المهاجم أولاً بالقدرة على تنفيذ تعليمات برمجية ذات امتيازات منخفضة على النظام المستهدف.

تسمح مشكلة في التحقق من مصدر الوكيل Apex One/SEP لمهاجم محلي بترقية امتيازاته. توجد هذه الثغرة في آلية الاتصال بين العمليات، وهي الطريقة التي تستخدمها العمليات المختلفة لمشاركة البيانات. لاستغلال هذه الثغرة، يجب أن يكون المهاجم قادرًا بالفعل على تنفيذ تعليمات برمجية ذات امتيازات منخفضة على النظام المستهدف.

يسمح خطأ في التحقق من صحة المصدر ضمن آلية الاتصال عبر الأنابيب المسماة (named pipe) في الوكيل لمهاجم محلي بترقية امتيازاته. لاستغلال هذه الثغرة، يجب أن يتمتع المهاجم أولاً بالقدرة على تنفيذ تعليمات برمجية ذات امتيازات منخفضة على النظام المستهدف.

قد تسمح مشكلة في التحقق من مصدر الوكيل لمهاجم محلي بترقية امتيازاته على التثبيتات المتأثرة. لاستغلال هذه الثغرة، يجب أن يتمتع المهاجم أولاً بالقدرة على تنفيذ تعليمات برمجية ذات امتيازات منخفضة على النظام المستهدف.

توجد مشكلة ”وقت الفحص ووقت الاستخدام“ (TOCTOU) في الوكيل، والتي تحدث عندما يقوم برنامج ما بفحص حالة ما (مثل وجود ملف أو أذوناته) ثم يستخدم نتيجة هذا الفحص، ولكن الحالة تتغير بين وقت الفحص ووقت الاستخدام. وقد يتيح ذلك لمهاجم محلي لديه بالفعل القدرة على تنفيذ تعليمات برمجية ذات امتيازات منخفضة على النظام المستهدف أن يرفع مستوى امتيازاته.

An origin validation error could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue.

An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue.

A format string vulnerability in the IPSec VPN feature could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer. However, such an attack would require detailed knowledge of an affected device’s memory layout and configuration. The vulnerability is related to the use of uncontrolled format strings.

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The issue is related to synchronization errors when using a shared resource.

A format string vulnerability could allow an authenticated IPSec VPN user to cause DoS conditions against the `deviceid` daemon by sending a crafted hostname to an affected device if it has the `Device Insight` feature enabled. This issue is related to the use of uncontrolled format strings in the `Device Insight` feature of the affected devices.

The issue is related to a post-authentication command injection vulnerability in the file upload binary, allowing an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP. This can be achieved by exploiting the vulnerability in the file upload process, which does not properly neutralize special elements used in the command.

A null pointer dereference issue in the Anti-Malware feature of Zyxel ATP and USG FLEX series firmware could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host. This issue is related to pointer dereference errors and can be exploited by a remote attacker to cause a denial of service.

The issue is related to an integer overflow vulnerability in the QuickSec IPSec toolkit used in the VPN feature of various Zyxel devices. This vulnerability could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.

The issue is related to insufficient data authentication in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system. This vulnerability is similar to, but not identical to, another known issue. It enables local attackers to escalate privileges on affected installations of the Trend Micro Apex One Security Agent.

A plug-in manager origin validation issue could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system.