CVE-2020-27018

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have...

CVE-2020-27018

CVE-2020-27018 affects Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1. The issue is a server-side request forgery (SSRF) vulnerability in the product’s web server that, when abused by an authenticated attacker, could grant access to web resources or parts of local files. V...

CVE-2020-27017

Trend Micro IMSVA 9.1 is affected by an XML External Entity Processing (XXE) vulnerability (CVE-2020-27017). An authenticated administrator/root can read arbitrary local files. Root cause involves XML data handling in IMSVA’s Java components. Impact is partial confidentiality (per CVSS) with no i...

CVE-2020-27016

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to a cross-site request forgery CSRF vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must...

CVE-2020-27016

CVE-2020-27016 affects Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1. The vulnerability is a CSRF flaw that could enable an attacker to modify policy rules by convincing an authenticated administrator to visit a crafted page. Exploitation requires the attacker to have pro...

CVE-2020-27693: Use of Password Hash With Insufficient Computational Effort

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 stores administrative passwords using a hash that is considered outdated...

CVE-2020-27016: Cross-Site Request Forgery (CSRF)

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to a cross-site request forgery CSRF vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must...

CVE-2020-27018: Server-Side Request Forgery (SSRF)

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have...

CVE-2020-27694: Undefined Security Weakness

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 has updated a specific critical library that may vulnerable to attack...

CVE-2020-27019: Missing Authentication for Critical Function

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key...

CVE-2020-27017: Improper Restriction of XML External Entity Reference

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to an XML External Entity Processing XXE vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to...

PT-2020-16769

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue concerns the storage of administrative passwords using an outdated hash. Recommendations For Trend Micro InterScan Messaging Security Virtual...

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) Server-Side Cross-Site Request Forgery Vulnerability

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA is an appliance for securing communications from Trend Micro. A cross-site request forgery vulnerability exists on the server side of the Trend Micro InterScan Messaging Security Virtual Appliance IMSVA. An attacker could use a web...

PT-2020-16598

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue is an information disclosure vulnerability that could allow an attacker to access a specific database and key. Recommendations For Trend Micro...

PT-2020-16597

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue allows an authenticated attacker to abuse the product's web server, granting access to web resources or parts of local files. An attacker must...

Trend Micro IMSVA CSRF / XML Injection / SSRF / File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Trend Micro InterScan Messaging Security Virtual Appliance IMSVA vulnerable version: 9.1.0 Critical Patch Build 2025 fixed version: 9.1....

CVE-2017-11391

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trendmicroimsvawidgetexec.rb 2025-10-23 21:12:58+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:48:59+00:00|...

CVE-2017-11392

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trendmicroimsvawidgetexec.rb 2025-10-23 21:12:58+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:48:59+00:00|...

CVE-2017-7896

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trendmicroimsvawidgetexec.rb 2025-10-23 21:12:58+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:48:59+00:00|...

Trend Micro IMSVA Management Portal Authentication Bypass (CVE-2018-3609)

An authentication bypass exists in Trend Micro InterScan Mail Security Virtual Appliance. The vulnerability is due to insufficient protection of a log file containing session credentials for authenticated users...