An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to t

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• 1password 1password7.0 and later · before 7.9.3
• 1password 1password7.0 and later · before 7.9.5
• 1password 1password7.0 and later · before 7.9.6
• 1password 1password7.0 and later · before 7.9.829
• 1password 1password8.0 and later · before 8.7.1
• 1password 1password8.0 and later · before 8.8.0-94
• 1password 1password8.0 and later · before 8.8.0-104
• 1password 1password in the browserbefore 2.3.4
• 1password command line interface1.0.0 and later · before 1.12.5
• 1password command-line2.0.0 and later · before 2.3.0
• 1password connectbefore 1.5.3
• 1password scim bridgebefore 2.3.2

Other highest-scoring records for the same primary product.

• CVE-2024-422191Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is
  31Monitor
• CVE-2020-18173A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.
  31Monitor
• CVE-2021-41795The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass.
  26Monitor
• CVE-2018-13042The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability.
  25Monitor
• CVE-2022-298681Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass.
  22Monitor
• CVE-2014-3753AgileBits 1Password through 1.0.9.340 allows security feature bypass
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.