An uncontrolled resource consumption flaw (CWE-770) in Tanium Enforce lets an authenticated user drive the Enforce component into resource exhaustion, degrading only the availability of that component. Deployments running Enforce 3.0 before 3.0.373, 2.9 before 2.9.736, or 2.10 before 2.10.778 are affected; patched builds are not exploitable. The CVSS score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue that requires a valid Enforce session - no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Tanium Comply builds 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326 enforce authorization incorrectly, allowing a low-privilege authenticated user with network access to read data outside their permitted scope. The flaw is rated CVSS 4.3 with confidentiality-only, low impact, and requires valid Comply credentials, so it is not exploitable without authentication; no public exploit was identified at time of analysis, and Tanium has released fixed builds.
Improper access controls in Tanium Enforce allow authenticated users with low privileges to read limited data they should not be able to access, with no integrity or availability impact. Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373 are affected; CVSS 3.1 scores this 4.3 as a network-reachable, low-privilege issue requiring a valid session. No public exploit code was identified at time of analysis, and the vendor has released fixed builds.
An authorization bypass (CWE-639, user-controlled key) in Netiket Information Technologies' EdoWEB lets a logged-in low-privileged user manipulate a key value to reach functionality or records that access-control lists should have restricted, exposing limited information (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Every EdoWEB build before 780-g7 is affected according to the vendor-tracked range, and exploitation first requires valid credentials - there is no anonymous path implied by the PR:L metric. The vendor has released a fix in 780-g7; there is no KEV listing and no public exploit identified at time of analysis, so priority is routine patching rather than emergency response.
Tanium Threat Response can write sensitive information into log files (CWE-532), exposing confidential data to anyone who can read the affected logs. Affected builds are Threat Response 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476; Tanium has released fixed versions. The CVSS 3.1 base score is 4.2 (MEDIUM) and the vuln.today decision label is 'this_month' - a low-to-moderate priority issue, not an emergency; no public exploit code or CISA KEV entry is reported in the supplied data. The vendor vector and the independent assessed vector differ on access path and prerequisites (network/high-privilege/user-interaction versus local/low-privilege/no-interaction), but both limit impact to confidentiality.