CVE-2018-6223

CVE-2018-6223 affects Trend Micro Email Encryption Gateway 5.5 (Build 1111.00). The connected materials describe a missing authentication for the appliance registration endpoint, allowing an attacker to manipulate configuration parameters and reset the administrator credentials (example shows cha...

CVE-2018-6227

The connected documentation provides concrete details for CVE-2018-6227 and related vulnerabilities in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00), including remote command execution, multiple XSS flaws, CSRF, XML external entity, and SQL injection in the TMEEG web console. Notable i...

CVE-2018-6225

CVE-2018-6225 corresponds to an XML External Entity (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00). The connected documents indicate the flaw arises from the pciExceptionXml parameter in configuration.jsp, enabling an attacker to exfiltrate sensitive data via XXE....

CVE-2018-6226

Reflected cross-site scripting XSS vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems...

CVE-2018-6228

The Connected docs confirm CVE-2018-6228 targets Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) and involves a SQL injection in policies.jsp via the hidEditId parameter, which is not sanitized before being passed to editPolicy.jsp. This leads to dynamic SQL construction (e.g., queries o...

CVE-2018-6229

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

CVE-2018-6230

CVE-2018-6230 is a SQL-injection flaw in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) search configuration script. The vulnerability resides in emailSearch.jsp where an unsanitized SearchString is concatenated into a dynamic SQL query, enabling an attacker to execute arbitrary SQL com...

CVE-2018-6224

A lack of cross-site request forgery CSRF protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticated requests to a user browsing an attacker-controlled domain...

CVE-2018-6221

An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their own...

CVE-2018-6224

CVE-2018-6224 relates to Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) and describes a lack of anti-CSRF protection in the web interface. The vulnerability allows an attacker to cause authenticated actions in a user’s session when the user visits a malicious domain, due to CSRF protect...

CVE-2018-6221

CVE-2018-6221 concerns Trend Micro Email Encryption Gateway 5.5 (Build 1111.00). The connected data shows an unvalidated software update mechanism that can be exploited by a man-in-the-middle to tamper with update files and inject a malicious RPM, enabling remote command execution as root on affe...

CVE-2018-6222

The CVE-2018-6222 family covers multiple vulnerabilities in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) found in the web console. Documented issues include: arbitrary log file locations enabling log manipulation and potential command execution (CVE-2018-6222); insecure update mechani...

CVE-2018-6220

CVE-2018-6220 corresponds to an arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) that can lead to remote code execution. Connected documents describe the root cause in the update mechanism and web console components: an insecure update flow downloaded...

CVE-2018-6230

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 search configuration script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

CVE-2018-6228

A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

Trend Micro Email Encryption Gateway Arbitrary Command Execution Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An arbitrary command execution vulnerability exists in Trend Micro Email...

Trend Micro Email Encryption Gateway Authentication Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An authentication vulnerability exists in Trend Micro Email Encryption Gateway 5...

Trend Micro Email Encryption Gateway Information Disclosure Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An information disclosure vulnerability exists in Trend Micro Email Encryption...

Trend Micro Email Encryption Gateway Cross-Site Request Forgery Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A cross-site request forgery vulnerability exists in Trend Micro Email Encryptio...

Trend Micro Email Encryption Gateway Arbitrary Command Execution Vulnerability (CNVD-2018-04486)

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An arbitrary command execution vulnerability exists in Trend Micro Email...