PT-2020-5366

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 Description A vulnerability in Trend Micro InterScan Web Security Virtual Appliance may allow remote attackers to execute arbitrary code on affected installations. The issue aris...

PT-2020-5367

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance versions prior to 6.5 SP2 Patch 4 Build 1901 Description The issue is related to a lack of protection for service data in the Trend Micro InterScan Web Security Virtual Appliance, which may...

PT-2020-5368

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 Description A vulnerability in the authentication procedure of Trend Micro InterScan Web Security Virtual Appliance may allow remote attackers to bypass authentication on affecte...

CVE-2019-9490: Undefined Security Weakness

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 could allow an non-authorized user to disclose administrative credentials. An attacker must be an authenticated user in order to exploit the vulnerability...

PT-2019-19682

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 Description A vulnerability could allow a non-authorized user to disclose administrative credentials. The attacker must be an authenticated user to exploit this issue...

PT-2018-16093

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance versions 9.0 through 9.1 Description A vulnerability in the management portal of the Trend Micro InterScan Messaging Security Virtual Appliance could allow an unauthenticated user to...

CVE-2018-3609: Insufficiently Protected Credentials

A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations...

CVE-2017-11392

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745...

CVE-2017-11392: Improper Neutralization of Special Elements used in a Command

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745...

CVE-2017-11391: Improper Neutralization of Special Elements used in a Command

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744...

Trend Micro InterScan Messaging Security Proxy Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro InterScan Messaging Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

PT-2017-11977

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Virtual Appliance versions 9.0 through 9.1 Description The issue allows remote attackers to execute arbitrary code on vulnerable installations by exploiting a proxy command injection vulnerability. This can be...

PT-2017-11978

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Virtual Appliance versions 9.0 through 9.1 Description The issue allows remote attackers to execute arbitrary code on vulnerable installations by exploiting a proxy command injection vulnerability. This can be...

Trend Micro InterScan Web Security Arbitrary Command Execution Vulnerability

Trend Micro InterScan Web Security is a Web security gateway that provides dynamic, integrated security for enterprise networks against Web-based threats. An arbitrary command execution vulnerability exists in Trend Micro InterScan Web Security. Port settings are not handled correctly due to SSH...

CVE-2017-7896

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 before CP 1644 has XSS...

CVE-2017-7896: Improper Neutralization of Input During Web Page Generation

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 before CP 1644 has XSS...

PT-2017-17979

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Virtual Appliance IMSVA version 9.1 before CP 1644 Description The issue is related to a cross-site scripting XSS problem. Recommendations For Trend Micro InterScan Messaging Security Virtual Appliance...

CVE-2017-6340

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that...

CVE-2017-6338

Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 allow an authenticated, remote user with low privileges like 'Reports Only' or 'Auditor' to change FTP Access Control Settings, create or modify reports, or upload an HTTPS Decryption...

PT-2017-17005

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance IWSVA versions 6.5 before CP 1746 Description The issue concerns Access Control problems, allowing an authenticated, remote user with low privileges, such as Reports Only or Auditor, to...