Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
Please note this vulnerability is similar, but not identical to CVE-2023-52328.
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations.
Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.
A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This vulnerability is similar to, but not identical to, CVE-2023-47201.
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This vulnerability is similar to, but not identical to, CVE-2023-47193.
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This vulnerability is similar to, but not identical to, CVE-2023-47195.
Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.
Please note, this vulnerability is similar to, but not identical to, CVE-2023-41176.
Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.
Please note, this vulnerability is similar to, but not identical to, CVE-2023-41178.
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.
Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the same as CVE-2022-35234.
CVE-2022-40139 is a high severity vulnerability in Trend Micro Apex One and Apex One as a Service involving improper validation of rollback mechanism components. This flaw could allow remote code execution. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2022-26871 is an arbitrary file upload vulnerability in Trend Micro Apex Central that could allow remote code execution. It has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
CVE-2019-18187 is a directory traversal vulnerability in Trend Micro OfficeScan that allows an attacker to extract files from a crafted zip archive to arbitrary locations on the server. This flaw can lead to remote code execution on the affected system. The vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information is provided in the available data.
CVE-2020-24557 is an improper access control vulnerability affecting Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows. This flaw allows attackers to manipulate a specific product folder to temporarily disable security features, abuse a Windows function, and escalate privileges. The vulnerability has been exploited in the wild. No explicit patch or remediation details are provided in the input data.
CVE-2020-8468 is a content validation escape vulnerability affecting Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents. This flaw allows an attacker to manipulate certain agent client components. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2021-36742 is an improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security products that allows privilege escalation. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
CVE-2020-8599 is a high-severity authentication bypass vulnerability in Trend Micro Apex One and OfficeScan server products. The vulnerability involves a vulnerable executable file that allows a remote attacker to write data to a path on affected installations and bypass root login. This flaw has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2020-8467 is a remote code execution vulnerability in Trend Micro Apex One and OfficeScan products. The flaw exists in a migration tool component and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
