Automox bug bounty programs

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

• CVE-2022-36122 High

  The Automox Agent before 40 on Windows incorrectly sets permissions on key files.

• CVE-2022-27904 High

  Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent install process.

• CVE-2022-24308 Medium

  Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the install process.

• CVE-2021-43326 High

  Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.

• CVE-2021-43325 High

  Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression.

• CVE-2021-26908 Low

  Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent.

• CVE-2021-26909 Low

  Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent.