CVE-2024-36307

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information about the agent on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro Apex One	>= 2019 (14.0), < 14.0.0.12980
Trend Micro, Inc.	Trend Micro Apex One as a Service	>= SaaS, < 14.0.13139
trendmicro	apex_one	>= 14.0, < 14.0.0.12980
trendmicro	apex_one	< 14.0.13139

References

https://success.trendmicro.com/dcx/s/solution/000298063Broken Link
https://www.zerodayinitiative.com/advisories/ZDI-24-573/Third Party Advisory
https://success.trendmicro.com/dcx/s/solution/000298063Broken Link
https://www.zerodayinitiative.com/advisories/ZDI-24-573/Third Party Advisory

Timeline

Published: Jun 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-363094.6Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part o CVE-2024-36314.3The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to m CVE-2024-363104.6Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SM CVE-2024-363114.6A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input valid CVE-2024-363155.7Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sens CVE-2024-363165.5The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a denia CVE-2024-363196.3Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causin CVE-2024-36326.8The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attac CVE-2024-363207.0Integer Overflow within atihdwt6.sys can allow a local attacker to cause out of bound read/write potentially leading to loss of confidential CVE-2024-363217.3Unquoted search path within AIM-T Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrar CVE-2024-363238.8Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized acc CVE-2024-363248.8Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbit