CVE-2019-18189: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan 11.0, XG and Worry-Free Business Security 9.5, 10.0 may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication...

CVE-2019-18188: Improper Neutralization of Special Elements used in a Command

Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution RCE. The remote process execution is bound to the IUSR...

Fast DNS: Zone Apex Mapping & DNSSEC

Introduction Along with its DDoS resilience and impressive global footprint, Fast DNS affords zone administrators additional technical flexibility and implementation options. One example is Zone Apex Mapping ZAM -- a feature that enables apex domains to be mapped directly to an Akamai edge IP. Th...

Edge DNS: Zone Apex Mapping & DNSSEC

Along with its DDoS resilience and impressive global footprint, Akamai Edge DNS offers zone administrators additional technical flexibility and implementation options to improve performance and simplify DNS operations. One example is zone apex mapping ZAM, a feature that enables top level hostnam...

How to Model Risk in an Apex Predator Cyber-World

The threat-intelligence researchers at Alphabet’s Chronicle have borrowed the apex predator concept from ecology to describe today’s multi-organizational, multinational threat actors — the evolution of which could provoke an overhaul of risk analysis and management. However, it’s important to kee...

Directory traversal

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan versions XG and 11.0, and Worry-Free Business Security versions 10.0, 9.5 and 9.0 could allow an attacker to modify arbitrary files on the affected product's management console...

CVE-2019-9489

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan versions XG and 11.0, and Worry-Free Business Security versions 10.0, 9.5 and 9.0 could allow an attacker to modify arbitrary files on the affected product's management console...

CVE-2019-9489

A directory traversal vulnerability exists in Trend Micro Apex One , OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 10.0, 9.5, and 9.0). This flaw allows an unauthenticated, remote attacker to send a URI containing directory traversal characters to disclose the cont...

CVE-2019-9489: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan versions XG and 11.0, and Worry-Free Business Security versions 10.0, 9.5 and 9.0 could allow an attacker to modify arbitrary files on the affected product's management console...

A week in security (March 11 – 17)

Last week on Malwarebytes Labs, we looked at the Lazarus group in our series about APT groups, we discussed the introduction of Payment Service Directive 2 PSD2 in the EU, we tackled Google’s Nest fiasco, and the launch of Mozilla's Firefox Send. In addition, we gave you an overview of the...

Payroll Provider Gives Extortionists a Payday

Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company's customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the...

Command Injection in apex-publish-static-files

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later...

GHSA-9JM3-5835-537M Command Injection in apex-publish-static-files

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later...

Command Injection

Overview Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later. References - HackerOne Report - security-wg - GitHub...

Command injection

A command injection vulnerability in the apex-publish-static-files npm module version 2.0.1 which allows arbitrary shell command execution through a maliciously crafted argument...

CVE-2018-16462

The CVE-2018-16462 entry concerns the npm package apex-publish-static-files. Affected versions are those before 2.0.1, where user-supplied input can trigger a command injection, enabling arbitrary shell command execution. Several connected sources corroborate this: the NVD entry describes a comma...

CVE-2018-16462: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the apex-publish-static-files npm module version 2.0.1 which allows arbitrary shell command execution through a maliciously crafted argument...

This Week in Security News: Apex One™ Release and Java Usage Tracker Flaws

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Apex One enters as the evolution of Trend Micro’s endpoint security solution for enterprise. Also, learn about Java Usage Tracker’s new...

Node.js third-party modules: [apex-publish-static-files] Command Injection on connectString

I would like to report a command injection vulnerability in the apex-publish-static-files npm module. It allows arbitrary shell command execution through a maliciously crafted argument. Module module name: apex-publish-static-files version: 2.0.0 npm page:...

Default Weak Password Vulnerability in Multiple Prologix Trango Products

Prologix Trango Apex Lynx and others are products of Prologix UAE.Apex Lynx is an outdoor microwave backhaul system.Apex Orion is a full-duplex point-to-point radio link for use in the Apex Lynx.The Apex Orion is a full-duplex point-to-point radio link for use in... A security vulnerability exist...