CVE-2019-19696

A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to...

Don’t Let the Vulnera-Bullies Win. Use our free tool to see if you are patched against Vulnerability CVE-2020-0601

So much for a quiet January! By now you must have heard about the new Microsoft® vulnerability CVE-2020-0601, first disclosed by the NSA making it the first Windows bug publicly attributed to the National Security Agency. This vulnerability is found in a cryptographic component that has a range o...

Trend Micro Password Manager vulnerable to information disclosure

Overview Password Manager provided by Trend Micro Incorporated contains an information disclosure vulnerability CWE-200. Under certain conditions, the information ID, password etc. managed by Password Manager are kept on the memory in plaintext. They may be retrieved when the memory scan is done...

CVE-2019-19696: Insufficiently Protected Credentials

A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to...

PT-2020-9749

Name of the Vulnerable Software and Affected Versions Trend Micro Password Manager version 3.8 Description A memory usage issue exists that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information. Recommendations For Trend Micro Passwo...

PT-2020-10222

Name of the Vulnerable Software and Affected Versions Trend Micro Password Manager for Windows and macOS affected versions not specified Description A security issue exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party. This could be used to create...

PT-2020-10394

Name of the Vulnerable Software and Affected Versions Trend Micro Security versions 15 through 160 Description A Persistent Arbitrary Code Execution issue exists in the Trend Micro Security consumer family of products, potentially allowing an attacker to create a malicious program to escalate...

Trend Micro Security (Consumer) Arbitrary Code Execution

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-PERSISTENT-ARBITRARY-CODE-EXECUTION.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.trendmicro.com Products Trend Micro Security...

Trend Micro Maximum Security 2019 - Privilege Escalation

Trend Micro Maximum Security 2019 - Privilege Escalation Exploit Title: Trend Micro Maximum Security 2019 - Privilege Escalation Date: 2020-1-16 Exploit Author: hyp3rlinx Vendor Homepage: www.trendmicro.com Version: Platform Microsoft Windows, Premium Security 2019 v15, Maximum Security 2019 v15...

CVE-2019-20357: Unquoted Search Path or Element

A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 v160 and 2019 v15 consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system...

CVE-2019-15625: Undefined Security Weakness

A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information...

JVN#37183636: Trend Micro Password Manager vulnerable to information disclosure

Password Manager provided by Trend Micro Incorporated generates a key pair and a root certificate on product installation. The generated private key is not properly protected and any non-administrative user can retrieve the private key CWE-200. Impact A malicious user who obtains the private key...

JVN#49593434: Trend Micro Password Manager vulnerable to information disclosure

Password Manager provided by Trend Micro Incorporated contains an information disclosure vulnerability CWE-200. Under certain conditions, the information ID, password etc. managed by Password Manager are kept on the memory in plaintext. They may be retrieved when the memory scan is done. Impact A...

Trend Micro Security 2019 Security Bypass Protected Service Tampering

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-SECURITY-BYPASS-PROTECTED-SERVICE-TAMPERING.txt + ISR: ApparitionSec Vendor www.trendmicro.com Product Trend Micro Security 2019 Consumer...

Trend Micro Password Manager Memory Usage Vulnerability

Trend Micro Password Manager is a secure password management solution from Trend Micro. A memory usage vulnerability exists in Trend Micro Password Manager version 3.8, which can be exploited by attackers to obtain sensitive information...

Trend Micro Maximum Security 2019 - Privilege Escalation

Exploit Title: Trend Micro Maximum Security 2019 - Privilege Escalation Date: 2020-1-16 Exploit Author: hyp3rlinx Vendor Homepage: www.trendmicro.com Version: Platform Microsoft Windows, Premium Security 2019 v15, Maximum Security 2019 v15 Internet Security 2019 v15, Antivirus + Security 2019 v15...

Trend Micro Maximum Security 2019 - Privilege Escalation Vulnerability

Exploit Title: Trend Micro Maximum Security 2019 - Privilege Escalation Exploit Author: hyp3rlinx Vendor Homepage: www.trendmicro.com Version: Platform Microsoft Windows, Premium Security 2019 v15, Maximum Security 2019 v15 Internet Security 2019 v15, Antivirus + Security 2019 v15 + Credits: John...

Trend Micro Password Manager Information Disclosure Vulnerability

Trend Micro Password Manager is a secure password management solution from Trend Micro. An information disclosure vulnerability exists in Trend Micro Password Manager version 5.0.0.1076 and earlier Windows and version 5.0.1047 and earlier MacOS, which is caused due to an error in the configuratio...

PT-2020-10223

Name of the Vulnerable Software and Affected Versions Trend Micro Security 2019 version 15 Description The issue allows an attacker to execute arbitrary code, potentially gaining elevated privileges and tampering with protected services by preventing them from starting. This can be achieved by...

CVE-2019-19697: Undefined Security Weakness

An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 v15 consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have...