CVE-2020-27019: Missing Authentication for Critical Function

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key...

CVE-2020-27017: Improper Restriction of XML External Entity Reference

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to an XML External Entity Processing XXE vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to...

CVE-2020-27693: Use of Password Hash With Insufficient Computational Effort

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 stores administrative passwords using a hash that is considered outdated...

CVE-2020-27016: Cross-Site Request Forgery (CSRF)

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to a cross-site request forgery CSRF vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must...

CVE-2020-27694: Undefined Security Weakness

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 has updated a specific critical library that may vulnerable to attack...

CVE-2020-27018: Server-Side Request Forgery (SSRF)

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have...

PT-2020-16597

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue allows an authenticated attacker to abuse the product's web server, granting access to web resources or parts of local files. An attacker must...

PT-2020-16769

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue concerns the storage of administrative passwords using an outdated hash. Recommendations For Trend Micro InterScan Messaging Security Virtual...

PT-2020-16596

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue is related to an XML External Entity Processing XXE vulnerability. This could allow an authenticated administrator to read arbitrary local files...

PT-2020-16770

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue concerns a critical library in the Trend Micro InterScan Messaging Security Virtual Appliance that may be vulnerable to attack. Recommendations...

PT-2020-16595

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 Description The issue allows an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. This can be...

CVE-2020-8603

A cross-site scripting vulnerability XSS in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or...

Cross site scripting

A cross-site scripting vulnerability XSS in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or...

Trend Micro InterScan Web Security Virtual Appliance Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is required to exploit this vulnerability. The specific flaw exists within the LogSettingHandler class. When parsing the mountdevi...

Trend Micro InterScan Web Security Virtual Appliance Apache Solr Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apache Solr application. When parsing t...

PT-2020-20233

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 Description A cross-site scripting issue may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this issu...

CVE-2020-8606: Improper Authentication

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance...

CVE-2020-8605: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability...

CVE-2020-8604: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations...

CVE-2020-8603: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability XSS in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or...