CVE-2024-1149highCWE-347

CVE-2024-1149: high-severity vulnerability in Snow Software Inventory Agent

Improper validation of update packages

Published · Updated

Follow this CVE+ Monitor Inventory Agent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.1%
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Snow Software · Inventory Agent
Related CVEs — Snow Software Inventory Agent

In the same product, most dangerous first.

CVE-2024-1150HIGHImproper validation of update packagesEPSS 0.1%