CVE-2021-25235

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about a content inspection configuration file...

CVE-2021-25230

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the contents of a scan connection exception file...

CVE-2021-25240

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain x64 agent hofitx information...

CVE-2021-25228

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about hotfix history...

CVE-2021-25234

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific notification configuration file...

CVE-2021-25232

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the SQL database...

CVE-2021-25241

A server-side request forgery SSRF information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep...

CVE-2021-25248

An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 and Services could allow an attacker to disclose sensitive information about a named pipe. Please note: an attacker must first obtain t...

CVE-2021-25249

An out-of-bounds write information disclosure vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 and Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain...

CVE-2021-25249

CVE-2021-25249 involves an out-of-bounds write information disclosure in Trend Micro Apex One (on‑prem and SaaS), OfficeScan XG SP1, and Worry‑Free Business Security (10.0 SP1/Services). The connected ZDI advisory details a local privilege escalation flaw in the TmCCSF.exe component, caused by la...

CVE-2021-25248

CVE-2021-25248 affects Trend Micro Apex One (on‑prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1/Services). The root cause is an out‑of‑bounds read due to insufficient validation in the vulnerable component (TmCCSF.exe per ZDI-21-118), allowing a local attacker with c...

CVE-2021-25248

An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 and Services could allow an attacker to disclose sensitive information about a named pipe. Please note: an attacker must first obtain t...

CVE-2021-25246

An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration...

CVE-2021-25246

CVE-2021-25246 concerns Trend Micro Apex One (including Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security) where an improper access control information disclosure allows an unauthenticated attacker to create a bogus agent on an affected server to perform valid configurati...

CVE-2021-25243

The CVE-2021-25243 entry describes an improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 that could allow an unauthenticated attacker to obtain patch level information. Connected documents confirm concrete...

CVE-2021-25243

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain patch level information...

CVE-2021-25242

CVE-2021-25242 affects Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1. Public sources in the provided documents describe an improper access control vulnerability that allows an unauthenticated user to obtain version and build information. ZDI...

CVE-2021-25241

Trend Micro CVE-2021-25241 is an SSRF information-disclosure vulnerability affecting Apex One and Worry-Free Business Security 10.0 SP1. Unauthenticated attackers could locate online agents by sweeping the affected web console. The ZDI advisory notes the flaw stems from improper access control in...

CVE-2021-25241

A server-side request forgery SSRF information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep...

CVE-2021-25242

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain version and build information...