CVE-2024-55968

HIGH Year: 2024
CVSS v3 Score
8.8
High
Weakness Type
CWE-267
View all →

Vulnerability Description

An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication (IPC). Specifically, the service does not verify the code requirements, entitlements, security flags, or version of any client attempting to establish a connection. This lack of proper logic validation allows malicious actors to exploit the service's methods via unauthorized client connections, and escalate privileges to root by abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.

Related Vulnerabilities

CVE-2021-32739

HIGH
CVSS:8.8(High)

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a ...

CWE-2672021

CVE-2023-32457

HIGH
CVSS:8.8(High)

Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentially exploit this vulnerability, leading to...

CWE-2672023

CVE-2023-41966

HIGH
CVSS:8.8(High)

The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter.

CWE-2672023

CVE-2024-39866

HIGH
CVSS:8.8(High)

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. This could allow an attacker with...

CWE-2672024

CVE-2024-42365

HIGH
CVSS:8.8(High)

Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AM...

CWE-2672024

CVE-2025-23015

HIGH
CVSS:8.8(High)

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via un...

CWE-2672025