131 matches found
CVE-2022-47529
CVE-2022-47529 RSA NetWitness Platform EDR Agent / 잘못된 접근 제어 - 코드 실행 EDR 에이전트의 보안 감사 중에, 불안전한 Win32 메모리 이벤트 객체를 대상으로 표준 사용자 권한만으로 서비스를 변조할 수 있는 새로운 벡터를 발견했습니다. 익스플로잇을 관리자로 실행하면 서비스 구성을 가로챌 수도 있습니다. CVE-2022-47529는 로컬 사용자가 엔드포인트 Windows 에이전트가 SIEM으로 이벤트를 전송하는 것을 중단시키거나, 에이전트가 사용자가 제공한 명령을 실행하도록 할 ...
Disable-TamperProtection
Tamper Protectionとその他のDefender / MDEコンポーネントの無効化 SYSTEM / TrustedInstaller権限を悪用して、WdFilterの設定（ALTITUDEレジストリキー）を改ざん・削除し、カーネルミニドライバをアンロードすることで、Tamper Protectionやその他のDefenderコンポーネントを無効化することが可能です。これはMicrosoftのDefender for Endpoint（MDE）にも影響し、MDEを標的に対するテレメトリやアクティビティの通知から遮断します。...
CVE-2026-40145
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-40145
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-40145 Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-40145
BeyondTrust Endpoint Privilege Management (Windows deployment) support utility has a tamper-protection bypass where, under certain conditions, protections on the utility process are not enforced as intended. CVSS 7.1 HIGH requires local access with high privileges. No affected versions, root caus...
EUVD-2026-60270
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-40145: Insufficient Granularity of Access Control
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
PT-2026-76713
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-0293: Protection Mechanism Failure
A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is...
EUVD-2025-210211
Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...
PT-2026-50186
Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...
CVE-2025-15642: Incorrect Default Permissions
Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963
CVE-2025-14963 involves the Trellix HX Agent driver file fekern.sys. The vulnerability enables a local user to obtain elevated privileges by leveraging a Bring Your Own Vulnerable Driver (BYOVD) to access the lsass.exe memory. The description notes that the vulnerable driver installed in a system...
BeyondTrust Privilege Management 安全漏洞
BeyondTrust Privilege Management is a permissions management tool provided by BeyondTrust Corporation for Windows and Mac SaaS environments. Versions of BeyondTrust Privilege Management prior to 25.7 contained a security vulnerability that could allow bypassing tamper-proof protection in Windows,...
CVE-2019-12752
The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in use on the resident system...