Authentication flaw

A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRegistration2 class. Authentication is required to exploit this vulnerability...

Information disclosure

A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability...

CVE-2018-10356

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability...

CVE-2018-10356

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability...

CVE-2018-10352

A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formConfiguration class. Authentication is required to exploit this vulnerability...

CVE-2018-10354

A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the LauncherServer. Authentication is required to exploit this vulnerability...

Remote code execution

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability...

CVE-2018-10355

CVE-2018-10355 affects Trend Micro Email Encryption Gateway (TMEEG) version 5.5. The vulnerability resides in the DBCrypto class, which stores user passwords using a hard-coded key in a recoverable format. An attacker who gains access to the target’s user database can exploit the flaw to recover ...

CVE-2018-10356

CVE-2018-10356 affects Trend Micro Email Encryption Gateway 5.5. A SQL injection vulnerability in the formRequestDomains class can lead to remote code execution. Auth is required to exploit, but at least one connected advisory notes authentication bypass or bypass potential, enabling arbitrary SQ...

CVE-2018-10351

Trend Micro Email Encryption Gateway 5.5 contains a SQL injection in the formRegistration2 class that enables a remote attacker to execute arbitrary SQL statements. Exploitation is possible remotely with network access and requires authentication (though ZDI notes the authentication can be bypass...

CVE-2018-10353

The CVE-2018-10353 entry concerns Trend Micro Email Encryption Gateway 5.5, where a flaw in the formChangePass class enables a SQL injection information disclosure vulnerability. The vulnerability potentially allows a remote attacker to disclose sensitive information on affected installations. Au...

CVE-2018-10356

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability...

CVE-2018-10355

An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover user passwords on vulnerable installations due to a flaw in the DBCrypto class. An attacker must first obtain access to the user database on the target system in order to exploi...

CVE-2018-10351

A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRegistration2 class. Authentication is required to exploit this vulnerability...

CVE-2018-10354

The CVE-2018-10354 issue affects Trend Micro Email Encryption Gateway 5.5, arising from a flaw in LauncherServer that permits command injection and remote code execution. A remote attacker could run arbitrary code on vulnerable installations; authentication is required to exploit per the primary ...

The vulnerability of the editPolicy.jsp script in the Email Encryption Gateway system allows a hacker to execute arbitrary SQL queries.

The vulnerability of the editPolicy.jsp script in the Email Encryption Gateway system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using the hidRuleld parameter...

CVE-2018-6228

A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

CVE-2018-6230

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 search configuration script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

CVE-2018-6226

Reflected cross-site scripting XSS vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems...

CVE-2018-6226

Reflected cross-site scripting XSS vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems...