Trend Micro Apex One Security Agent ntrmv Uncontrolled Search Path Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Furthermore, privilege escalatio...

Trend Micro Apex One Damage Cleanup Engine Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Trend Micro Apex One Virus Scan Engine Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Furthermore, the product is...

Trend Micro Apex Central ConvertFromJson Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the ConvertFromJson method. The issue results from the la...

Trend Micro Apex One Data Loss Prevention Uncontrolled Search Path Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One Security Agent. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi...

Trend Micro Apex Central GetReportDetailView Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the GetReportDetailView method. The issue results from th...

The vulnerability of the modTMCM widget of the security monitoring and management tool Trend Micro Apex Central allows a malicious actor to upload arbitrary files.

The vulnerability of the modTMCM widget in the Trend Micro Apex Central security monitoring and management tool is related to unpredictable behavior of the function due to inconsistencies in parameter values. Exploiting this vulnerability allows an attacker operating remotely to upload arbitrary...

The vulnerability of the getBlock() function in the monitoring and security management tool Trend Micro Apex Central allows a threat to execute arbitrary code.

The vulnerability of the getBlock function in the Trend Micro Apex Central security monitoring and management tool is related to the failure to take measures to neutralize specific elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the getObjWGFServiceApiByApiName() function in the security monitoring and management tool Trend Micro Apex Central allows a attacker to execute arbitrary code.

The vulnerability of the getObjWGFServiceApiByApiName function in the monitoring and security management tool Trend Micro Apex Central is related to unpredictable behavior of the function due to inconsistencies in parameter values. Exploiting this vulnerability could allow an attacker operating...

Malicious code in @fmr-pr103625/apex-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 87f7d6eefb4242b16b30fbedd12103828145a5d82610917904a48a2ee5b1f063 The OpenSSF Package Analysis project identified '@fmr-pr103625/apex-core' @ 1.999.2 npm as malicious. It is considered malicious because: - The...

MAL-2025-4427 Malicious code in @fmr-pr103625/apex-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 87f7d6eefb4242b16b30fbedd12103828145a5d82610917904a48a2ee5b1f063 The OpenSSF Package Analysis project identified '@fmr-pr103625/apex-core' @ 1.999.2 npm as malicious. It is considered malicious because: - The...

CVE-2024-47085

This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters cCdslClicentcode and cLdClientCode in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to...

CVE-2024-47086

This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by providing arbitrary OTP value for authentication and subsequently changing its API...

Vulnerabilities fixed in Trend Micro Apex Central

Trend Micro has fixed vulnerabilities in Apex Central. A malicious party could exploit the vulnerabilities to execute a Server-Side Request Forgery SSRF, or through unlimited file uploads, potentially execute arbitrary code on the vulnerable system, or gain access to sensitive data. Trend Micro h...

CVE-2024-47088

This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to...

CVE-2024-47087

This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters Client ID, DPID or BOID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to exposure of sensitive...

CVE-2024-47089

This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating the transaction token ID in the API request leading to unauthorized access and...

CVE-2023-34144

An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target syst...

CVE-2023-34148

An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first...

CVE-2023-0587

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory...