Search criteria
3 vulnerabilities
CVE-2026-1290 (GCVE-0-2026-1290)
Vulnerability from cvelistv5 – Published: 2026-01-21 15:25 – Updated: 2026-01-21 15:49
VLAI
Title
[PI141230] Fixed A broken access control issue.
Summary
Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
1 reference
Date Public
2026-01-20 15:10
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-21T15:48:43.243242Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T15:49:21.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Jamf Pro",
"vendor": "Jamf",
"versions": [
{
"lessThanOrEqual": "11.24",
"status": "affected",
"version": "11.20",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-01-20T15:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.\u003cp\u003eThis issue affects Jamf Pro: from 11.20 through 11.24.\u003c/p\u003e"
}
],
"value": "Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "unspecified impact"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305: Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T15:25:19.543Z",
"orgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e",
"shortName": "JAMF"
},
"references": [
{
"url": "https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-11.24.0/page/Resolved_Issues.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "[PI141230] Fixed A broken access control issue.",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e",
"assignerShortName": "JAMF",
"cveId": "CVE-2026-1290",
"datePublished": "2026-01-21T15:25:19.543Z",
"dateReserved": "2026-01-21T15:24:32.098Z",
"dateUpdated": "2026-01-21T15:49:21.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10183 (GCVE-0-2024-10183)
Vulnerability from cvelistv5 – Published: 2024-10-22 17:50 – Updated: 2024-10-22 18:11
VLAI
Title
Arbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege Escalation
Summary
A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10183",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T18:11:42.682541Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T18:11:54.102Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pro",
"vendor": "Jamf",
"versions": [
{
"lessThanOrEqual": "11.5",
"status": "affected",
"version": "11.1",
"versionType": "Pro"
},
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "JRA"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "REQON (Reporter Organization)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Jamf Pro\u0027s Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems."
}
],
"value": "A vulnerability in Jamf Pro\u0027s Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T17:50:53.752Z",
"orgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e",
"shortName": "JAMF"
},
"references": [
{
"url": "https://learn.jamf.com/en-US/bundle/jamf-remote-assist-release-notes/page/Jamf_Remote_Assist_Release_History.html#ariaid-title4"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade\u0026nbsp;On-Premises Jamf Pro instances to greater than 11.5.\u003cbr\u003e"
}
],
"value": "Upgrade\u00a0On-Premises Jamf Pro instances to greater than 11.5."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Arbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e",
"assignerShortName": "JAMF",
"cveId": "CVE-2024-10183",
"datePublished": "2024-10-22T17:50:53.752Z",
"dateReserved": "2024-10-18T22:20:03.190Z",
"dateUpdated": "2024-10-22T18:11:54.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4395 (GCVE-0-2024-4395)
Vulnerability from cvelistv5 – Published: 2024-06-27 21:28 – Updated: 2024-08-01 20:40
VLAI
Title
Lack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege Escalation
Summary
The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://khronokernel.com/macos/2024/05/01/CVE-202… | technical-descriptionthird-party-advisory |
| https://github.com/Jamf-Concepts/jamf-compliance-… | vendor-advisoryrelease-notes |
| https://trusted.jamf.com/docs/establishing-compli… | productpatch |
| https://github.com/Jamf-Concepts/jamf-compliance-… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| JAMF | Jamf Compliance Editor |
Affected:
1 , < 1.3.1
(custom)
|
|
| jamf | jamf_compliance_editor |
Affected:
1 , < 1.3.1
(custom)
cpe:2.3:a:jamf:jamf_compliance_editor:1.3.1:*:*:*:*:*:*:* |
Date Public
2024-05-01 07:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:jamf:jamf_compliance_editor:1.3.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "jamf_compliance_editor",
"vendor": "jamf",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-4395",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-28T14:38:43.447648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-28T14:44:50.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:40:47.140Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"technical-description",
"third-party-advisory",
"x_transferred"
],
"url": "https://khronokernel.com/macos/2024/05/01/CVE-2024-4395.html"
},
{
"tags": [
"vendor-advisory",
"release-notes",
"x_transferred"
],
"url": "https://github.com/Jamf-Concepts/jamf-compliance-editor/raw/v1.3.1/Jamf%20Compliance%20Editor%20-%20User%20Guide.pdf"
},
{
"tags": [
"product",
"patch",
"x_transferred"
],
"url": "https://trusted.jamf.com/docs/establishing-compliance-baselines#support"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/Jamf-Concepts/jamf-compliance-editor/releases/download/v1.3.1/JamfComplianceEditor.v1.3.1.pkg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"MacOS"
],
"product": "Jamf Compliance Editor",
"vendor": "JAMF",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "1",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-05-01T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation.\u003c/p\u003e"
}
],
"value": "The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:D/RE:M/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T21:28:35.198Z",
"orgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e",
"shortName": "JAMF"
},
"references": [
{
"tags": [
"technical-description",
"third-party-advisory"
],
"url": "https://khronokernel.com/macos/2024/05/01/CVE-2024-4395.html"
},
{
"tags": [
"vendor-advisory",
"release-notes"
],
"url": "https://github.com/Jamf-Concepts/jamf-compliance-editor/raw/v1.3.1/Jamf%20Compliance%20Editor%20-%20User%20Guide.pdf"
},
{
"tags": [
"product",
"patch"
],
"url": "https://trusted.jamf.com/docs/establishing-compliance-baselines#support"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Jamf-Concepts/jamf-compliance-editor/releases/download/v1.3.1/JamfComplianceEditor.v1.3.1.pkg"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Jamf Compliance Editor 1.3.1"
}
],
"value": "Upgrade to Jamf Compliance Editor 1.3.1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of Client Validation in Jamf Compliance Editor\u0027s Helper Service May Result in Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e",
"assignerShortName": "JAMF",
"cveId": "CVE-2024-4395",
"datePublished": "2024-06-27T21:28:35.198Z",
"dateReserved": "2024-05-01T17:32:09.801Z",
"dateUpdated": "2024-08-01T20:40:47.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}