CVE-2018-6230

CVE-2018-6230 is a SQL-injection flaw in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) search configuration script. The vulnerability resides in emailSearch.jsp where an unsanitized SearchString is concatenated into a dynamic SQL query, enabling an attacker to execute arbitrary SQL com...

CVE-2018-6224

A lack of cross-site request forgery CSRF protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticated requests to a user browsing an attacker-controlled domain...

CVE-2018-6221

An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their own...

CVE-2018-6222

The CVE-2018-6222 family covers multiple vulnerabilities in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) found in the web console. Documented issues include: arbitrary log file locations enabling log manipulation and potential command execution (CVE-2018-6222); insecure update mechani...

CVE-2018-6219

An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdrop and tamper with certain types of update data...

CVE-2018-6225

CVE-2018-6225 corresponds to an XML External Entity (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00). The connected documents indicate the flaw arises from the pciExceptionXml parameter in configuration.jsp, enabling an attacker to exfiltrate sensitive data via XXE....

CVE-2018-6221

CVE-2018-6221 concerns Trend Micro Email Encryption Gateway 5.5 (Build 1111.00). The connected data shows an unvalidated software update mechanism that can be exploited by a man-in-the-middle to tamper with update files and inject a malicious RPM, enabling remote command execution as root on affe...

CVE-2018-6227

A stored cross-site scripting XSS vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject client-side scripts into vulnerable systems...

CVE-2018-6225

An XML external entity injection XXE vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protected configuration script...

CVE-2018-6219

CVE-2018-6219 affects Trend Micro Email Encryption Gateway 5.5 (Build 1111.00). The vulnerability is an Insecure Update via HTTP where update communications are unencrypted, enabling a MITM attacker to eavesdrop on and tamper with update data. The connected documents corroborate that the issue is...

CVE-2018-6226

CVE-2018-6226 affects Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) and documents multiple web-UI vulnerabilities. The connected sources describe cross-site scripting flaws in keymanserverconfig.jsp and mimebuilderconfig.jsp (parameters like keyAge, deniedKeysExpireTimeout, encryptionX...

CVE-2018-6229

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

CVE-2018-6223

A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate the registration process of the product to reset configuration parameters...

CVE-2018-6226

Reflected cross-site scripting XSS vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems...

CVE-2018-6224

CVE-2018-6224 relates to Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) and describes a lack of anti-CSRF protection in the web interface. The vulnerability allows an attacker to cause authenticated actions in a user’s session when the user visits a malicious domain, due to CSRF protect...

Trend Micro Email Encryption Gateway Arbitrary Command Execution Vulnerability (CNVD-2018-04486)

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An arbitrary command execution vulnerability exists in Trend Micro Email...

Trend Micro Email Encryption Gateway Security Bypass Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A security bypass vulnerability exists in Trend Micro Email Encryption Gateway 5...

Trend Micro Email Encryption Gateway Arbitrary Command Execution Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An arbitrary command execution vulnerability exists in Trend Micro Email...

Trend Micro Email Encryption Gateway Information Disclosure Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An information disclosure vulnerability exists in Trend Micro Email Encryption...

Trend Micro Email Encryption Gateway Authentication Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An authentication vulnerability exists in Trend Micro Email Encryption Gateway 5...