CVE-2022-37347

CVE-2022-37347 affects Trend Micro Security 2021/2022 (Consumer). It is an Out-Of-Bounds Read Information Disclosure vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash. Public sources in the connected docs confirm the issue and r...

CVE-2022-37347

Trend Micro Security 2021 and 2022 Consumer is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the sa...

CVE-2022-34893

Trend Micro Security 2022 consumer has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine...

CVE-2022-34893

CVE-2022-34893 – Trend Micro Security 2022 (consumer) is a local privilege-escalation flaw described as a “link following vulnerability” in multiple sources. The root cause involves manipulation of a mountpoint via a symbolic link, enabling a low-privileged attacker with local access to escalate ...

Zero-day vulnerability uncovered in Trend Micro Apex One

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability, along with several other issues, has been addressed by Trend Micro. It has been identified as CVE-2022- 40139 and could allow attackers to execute remote code...

Delta Electronics DIAEnergie

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Delta Electronics Equipment: DIAEnergie Vulnerabilities: Use of Hard-coded Credentials 2. UPDATE OR REPOSTED INFORMATION This updated advisory is a follow-up to the original advisory titled...

CVE-2022-40141: Undefined Security Weakness

A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication strings that may contain some identification attributes of a particular Apex One server...

CVE-2022-40140: Origin Validation Error

An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2022-40139: Undefined Security Weakness

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code executio...

CVE-2022-38764: Incorrect Default Permissions

A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder om the product installer...

CVE-2022-37348: Out-of-bounds Read

Trend Micro Security 2021 and 2022 Consumer is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the sa...

CVE-2022-37347: Out-of-bounds Read

Trend Micro Security 2021 and 2022 Consumer is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the sa...

CVE-2022-34893: Improper Link Resolution Before File Access

Trend Micro Security 2022 consumer has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine...

CVE-2022-40144: Improper Authentication

A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations...

CVE-2022-40980: Undefined Security Weakness

A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with access to the Management Server to delete files. This issue was resolved in 9.8 SP5 Critical Patch 2...

CVE-2022-40142: Improper Privilege Management

A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local attacker to create a writable folder in an arbitrary location and escalate privileges on affected installations. Please note: an attacker mus...

CVE-2022-40143: Improper Link Resolution Before File Access

A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbitrary code with elevated privileges. Please note: an attack...

PT-2022-25650

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security for Enterprise version 9.8 SP5 Description A potential unauthenticated file deletion issue could allow an attacker with access to the Management Server to delete files. Recommendations For Trend Micro Mobile Securit...

Trend Micro Security (Consumer) Buffer Error Vulnerability

Trend Micro Security Consumer is an antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Security 2021, 2022 versions 17.7.1383 and earlier, which stems from a susceptibility to an out-of-bounds read information disclosure vulnerability that can be exploited by an...

CVE-2022-40144

Trend Micro Apex One and Trend Micro Apex One as a Service are affected by CVE-2022-40144, where an attacker who can access the admin console or the system can bypass login authentication by sending specially crafted requests. The JVN/NVD entries describe a broader set of related vulnerabilities ...