Lays

An origin validation error in the process protection communication mechanism allows a local attacker to escalate privileges. To exploit this issue, the attacker must first have the ability to execute low-privileged code on the target system.

An origin validation error in the process protection mechanism allows a local attacker to escalate privileges. To exploit this issue, the attacker must first have the ability to execute low-privileged code on the target system.

An origin validation issue in the Apex One/SEP agent allows a local attacker to escalate privileges. This flaw exists within an inter-process communication mechanism, which is the method used by different processes to share data. To exploit this, an attacker must already have the ability to execute low-privileged code on the target system.

An origin validation error in the agent's named pipe communication mechanism allows a local attacker to escalate privileges. To exploit this issue, the attacker must first have the ability to execute low-privileged code on the target system.

An origin validation issue in the agent could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first have the ability to execute low-privileged code on the target system.

A time-of-check time-of-use (TOCTOU) issue exists in the agent, which occurs when a program checks a condition (such as a file's existence or permissions) and then uses the result of that check, but the condition changes between the check and the use. This could allow a local attacker who already has the ability to execute low-privileged code on the target system to escalate privileges.

An origin validation error could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue.

An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue.

A format string vulnerability in the IPSec VPN feature could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer. However, such an attack would require detailed knowledge of an affected device’s memory layout and configuration. The vulnerability is related to the use of uncontrolled format strings.

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The issue is related to synchronization errors when using a shared resource.

A format string vulnerability could allow an authenticated IPSec VPN user to cause DoS conditions against the `deviceid` daemon by sending a crafted hostname to an affected device if it has the `Device Insight` feature enabled. This issue is related to the use of uncontrolled format strings in the `Device Insight` feature of the affected devices.

The issue is related to a post-authentication command injection vulnerability in the file upload binary, allowing an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP. This can be achieved by exploiting the vulnerability in the file upload process, which does not properly neutralize special elements used in the command.

A null pointer dereference issue in the Anti-Malware feature of Zyxel ATP and USG FLEX series firmware could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host. This issue is related to pointer dereference errors and can be exploited by a remote attacker to cause a denial of service.

The issue is related to an integer overflow vulnerability in the QuickSec IPSec toolkit used in the VPN feature of various Zyxel devices. This vulnerability could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.

The issue is related to insufficient data authentication in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system. This vulnerability is similar to, but not identical to, another known issue. It enables local attackers to escalate privileges on affected installations of the Trend Micro Apex One Security Agent.

A plug-in manager origin validation issue could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system.

The issue is related to an origin validation vulnerability in the Trend Micro Apex One security agent, which could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system.