PT-2024-38449 · Trellix · Trellix Fx +5

Name of the Vulnerable Software and Affected Versions: Trellix NX, EX, FX, AX, IVX, and CMS affected versions not specified Description: An authenticated user can access restricted files from Trellix products using path traversal for the URL of network anomaly download artifact. This issue allows...

Trellix多款产品 安全漏洞

Trellix NX and others are a range of security software from FireEye Trellix USA. A security vulnerability exists in various Trellix products. An attacker exploiting the vulnerability could read or download arbitrary files on the server. The following products are affected: NX, EX, FX, AX, IVX and...

Trellix Secure Web Gateway Information Disclosure Vulnerability

Trellix Secure Web Gateway Trellix SWG is a security gateway from FireEye USA Trellix. An information disclosure vulnerability exists in Trellix Secure Web Gateway SWG version 12.x prior to 12.2.10 and version 11.x prior to 11.2.24, which stems from a browser bypassing the same-origin policy unde...

Info Stealing Campaign Uses DLL Sideloading Through Legitimate Cisco Webex’s Binaries for Initial Execution and Defense Evasion

Info Stealing Campaign Uses DLL Sideloading Through Legitimate Cisco Webex’s Binaries for Initial Execution and Defense Evasion By Ale Houspanossian · June 17, 2024 Case Summary It was a quiet Monday morning in March 2024 when the EDR researchers with our Trellix Advanced Research Center identifi...

CVE-2024-5671

Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager...

CVE-2024-5671

Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager...

CVE-2024-5671

Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager...

Trellix IPS Manager Security Vulnerability

Trellix IPS Manager is a next-generation IPS for local and virtual networks from FireEye Trellix USA. A security vulnerability exists in Trellix IPS Manager, Central Manager, and Local Manager. An attacker could exploit the vulnerability to obtain sensitive information...

Trellix IPS Manager Code Issue Vulnerability

Trellix IPS Manager is a next-generation IPS for local and virtual networks from FireEye Trellix USA. Trellix IPS Manager suffers from a code issue vulnerability that stems from insecure deserialization. An attacker exploiting this vulnerability could execute arbitrary code...

Trellix XDR XConsole Cross-Site Scripting Vulnerability

Trellix XDR XConsole is an interface from Trellix USA that simplifies the Trellix XDR user experience. A cross-site scripting vulnerability exists in Trellix XDR XConsole, which stems from the presence of a cross-site scripting vulnerability that could allow an attacker to perform HTML injection...

DarkGate again but... Improved?

DarkGate again but... Improved? By Ernesto Fernández Provecho · June 3, 2024 Executive summary During 2023, DarkGate made a comeback with a version full of new features, becoming one of the most preferred Remote Access Trojans RATs by malicious actors. However, this momentum also required...

Fake Antivirus Sites Spread Malware Disguised as Avast, Malwarebytes, Bitdefender

By Deeba Ahmed Trellix research exposes the dangers of fake antivirus websites disguised as legitimate security software but harbouring malware. Learn… This is a post from HackRead.com Read the original post: Fake Antivirus Sites Spread Malware Disguised as Avast, Malwarebytes, Bitdefender...

A Catalog of Hazardous AV Sites – A Tale of Malware Hosting

A Catalog of Hazardous AV Sites – A Tale of Malware Hosting By Trellix · May 23, 2024 This blog was written by Gurumoorthi Ramanathan Executive summary In mid-April 2024, Trellix Advanced Research Center team members observed multiple fake AV sites hosting highly sophisticated malicious files suc...

CVE-2024-4844

Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator ePO on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was...

CVE-2024-4844

Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator ePO on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was...

Trellix ePolicy Orchestrator 安全漏洞

Trellix ePolicy Orchestrator is a centralized security management platform from Trellix. A security vulnerability exists in Trellix ePolicy Orchestrator versions prior to 5.10 that stems from the presence of an insecure direct object reference that allows a low-privileged user to manipulate clien...

PT-2024-33110 · Trellix · Trellix Epolicy Orchestrator

Name of the Vulnerable Software and Affected Versions: Trellix ePolicy Orchestrator ePO on Premise versions prior to 5.10 Service Pack 1 Update 2 Description: A hardcoded credentials issue allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file,...

Trellix ePolicy Orchestrator 信任管理问题漏洞

Trellix ePolicy Orchestrator is a centralized security management platform from Trellix. A trust management issue vulnerability exists in Trellix ePolicy Orchestrator versions prior to 5.10 that stems from the use of hard-coded credentials that allow an attacker with administrator privileges to...

Midnight Blizzard Attack Detection in Trellix Helix

Midnight Blizzard Attack Detection in Trellix Helix By Ian Shefferman · March 18, 2024 On January 25, 2024, Microsoft reported a breach of their systems by the Russian APT group Midnight Blizzard, also known as APT29 and Cozy Bear. The attackers performed a password spray, compromised a Microsoft...

CVE-2023-6072

A cross-site scripting vulnerability in Trellix Central Management CM prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard...