CVE-2024-45334

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to product configurations and functions.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-453355.5Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted viru CVE-2024-453366.1The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorizatio CVE-2024-453379.1Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible CVE-2024-453385.3An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremel CVE-2024-453397.1When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file pat CVE-2024-45346.1The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as es CVE-2024-453408.8Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credenti CVE-2024-453416.1A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certifica CVE-2024-453468.8The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initia CVE-2024-453479.6An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is fla CVE-2024-453488.8Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of use CVE-2024-45358.8The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logg