CVE-2022-34893

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Security (Consumer)	2022 (17.7.1179 and below)

References

https://helpcenter.trendmicro.com/en-us/article/tmka-11053Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1175/Third Party Advisory, VDB Entry
https://helpcenter.trendmicro.com/en-us/article/tmka-11053Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1175/Third Party Advisory, VDB Entry

Timeline

Published: Sep 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-348945.3In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services CVE-2022-348997.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attac CVE-2022-34907.2The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings CVE-2022-349007.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attac CVE-2022-349017.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attac CVE-2022-349027.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attac CVE-2022-349036.5GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constrai CVE-2022-349067.5A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor CVE-2022-349079.8An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticate CVE-2022-349087.5An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some f CVE-2022-349099.1An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass CVE-2022-34917.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.