CVE-2019-18188

Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution RCE. The remote process execution is bound to the IUSR...

Multiple Trend Micro Products CVE-2019-18189 Unspecified Directory Traversal Vulnerability

Description Multiple Trend Micro products are prone to an unspecified directory-traversal vulnerability. Remote attackers can use specially crafted requests with directory-traversal sequences '../' to access arbitrary files that contain sensitive information. This may aid in further attacks. The...

Trend Micro Apex One CVE-2019-18188 Command Injection Vulnerability

Description Trend Micro Apex One is prone to a command-injection vulnerability because it fails to properly sanitize user-supplied input. Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will...

Fast DNS: Zone Apex Mapping & DNSSEC

Introduction Along with its DDoS resilience and impressive global footprint, Fast DNS affords zone administrators additional technical flexibility and implementation options. One example is Zone Apex Mapping ZAM -- a feature that enables apex domains to be mapped directly to an Akamai edge IP. Th...

Edge DNS: Zone Apex Mapping & DNSSEC

Along with its DDoS resilience and impressive global footprint, Akamai Edge DNS offers zone administrators additional technical flexibility and implementation options to improve performance and simplify DNS operations. One example is zone apex mapping ZAM, a feature that enables top level hostnam...

How to Model Risk in an Apex Predator Cyber-World

The threat-intelligence researchers at Alphabet’s Chronicle have borrowed the apex predator concept from ecology to describe today’s multi-organizational, multinational threat actors — the evolution of which could provoke an overhaul of risk analysis and management. However, it’s important to kee...

Directory traversal

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan versions XG and 11.0, and Worry-Free Business Security versions 10.0, 9.5 and 9.0 could allow an attacker to modify arbitrary files on the affected product's management console...

CVE-2019-9489

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan versions XG and 11.0, and Worry-Free Business Security versions 10.0, 9.5 and 9.0 could allow an attacker to modify arbitrary files on the affected product's management console...

CVE-2019-9489

The CVE-2019-9489 entry describes a directory traversal vulnerability in Trend Micro products: Apex One, OfficeScan (XG and 11.0) , and Worry-Free Business Security (WFBS) 10.0, 9.5, 9.0 . The underlying issue allows an unauthenticated, remote attacker to send crafted URIs containing directory tr...

A week in security (March 11 – 17)

Last week on Malwarebytes Labs, we looked at the Lazarus group in our series about APT groups, we discussed the introduction of Payment Service Directive 2 PSD2 in the EU, we tackled Google’s Nest fiasco, and the launch of Mozilla's Firefox Send. In addition, we gave you an overview of the...

Payroll Provider Gives Extortionists a Payday

Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company's customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the...

GHSA-9JM3-5835-537M Command Injection in apex-publish-static-files

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later...

Command Injection in apex-publish-static-files

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later...

Command Injection

Overview Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later. References - HackerOne Report - security-wg - GitHub...

Command injection

A command injection vulnerability in the apex-publish-static-files npm module version 2.0.1 which allows arbitrary shell command execution through a maliciously crafted argument...

CVE-2018-16462

The CVE-2018-16462 entry concerns the npm package apex-publish-static-files. Affected versions are those before 2.0.1, where user-supplied input can trigger a command injection, enabling arbitrary shell command execution. Several connected sources corroborate this: the NVD entry describes a comma...

This Week in Security News: Apex One™ Release and Java Usage Tracker Flaws

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Apex One enters as the evolution of Trend Micro’s endpoint security solution for enterprise. Also, learn about Java Usage Tracker’s new...

Node.js third-party modules: [apex-publish-static-files] Command Injection on connectString

I would like to report a command injection vulnerability in the apex-publish-static-files npm module. It allows arbitrary shell command execution through a maliciously crafted argument. Module module name: apex-publish-static-files version: 2.0.0 npm page:...

Default Weak Password Vulnerability in Multiple Prologix Trango Products

Prologix Trango Apex Lynx and others are products of Prologix UAE.Apex Lynx is an outdoor microwave backhaul system.Apex Orion is a full-duplex point-to-point radio link for use in the Apex Lynx.The Apex Orion is a full-duplex point-to-point radio link for use in... A security vulnerability exist...

CVE-2016-10305

Trango Apex = 2.1.1, ApexLynx 2.0, ApexOrion 2.0, ApexPlus = 3.2.0, Giga = 2.6.1, GigaLynx 2.0, GigaOrion 2.0, GigaPlus = 3.2.3, GigaPro = 1.4.1, StrataLink 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software...