PT-2017-13244

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11.0 and XG Description The issue allows local attackers to execute arbitrary code and escalate privileges to resources normally reserved for the kernel on vulnerable installations by exploiting tmwfp.sys. An...

Trend Micro OfficeScan tmwfp Memory Corruption Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Trend Micro OfficeScan. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Trend Micro OfficeScan tmwfp Memory Corruption Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Trend Micro OfficeScan. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

PT-2017-3009

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11.0 and XG Description The issue is caused by a buffer overflow in memory, which can be exploited by a remote attacker to access the cgiShowClientAdm.exe on the OfficeScan server and cause memory corruption. Th...

Trend Micro OfficeScan Command Injection Vulnerability

Trend Micro OfficeScan is a suite of distributed anti-virus software from Trend Micro. A command injection vulnerability exists in Trend Micro OfficeScan version 11 and XG 12. A remote attacker could exploit this vulnerability to execute arbitrary code...

Command injection

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544...

CVE-2017-11394

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544...

CVE-2017-11394

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544...

CVE-2017-11393

Trend Micro OfficeScan is affected by a Proxy.php parameter parsing flaw that enables remote code execution via the tr parameter in the Web Console’s Proxy.php. Affected products include OfficeScan 11 and XG (12). The vulnerability allows code execution under the current service context; exploita...

CVE-2017-11393

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543...

CVE-2017-11394

CVE-2017-11394 describes a proxy.php parameter handling flaw in Trend Micro OfficeScan 11 and XG (12) that allows remote command execution via improper validation of HTTP parameters (Proxy.php). The vulnerability enables an attacker to execute arbitrary code on vulnerable installations. Public re...

PT-2017-2557

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11 and 12 Description The issue is related to a proxy command injection vulnerability that allows remote attackers to execute arbitrary code on vulnerable installations. This can be exploited by parsing the tr...

CVE-2017-11393: Improper Input Validation

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543...

CVE-2017-11394: Improper Input Validation

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544...

PT-2017-2601

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11 and 12 Description The issue is caused by a command injection vulnerability in the proxy server setup during installation, allowing a remote attacker to execute arbitrary code by exploiting the T parameter in...

PT-2017-18539

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11.0 before SP1 CP 6325 Trend Micro OfficeScan XG before CP 1352 Description The issue is related to a crafted URI using a blocked website, which can lead to XSS. Recommendations For Trend Micro OfficeScan versi...

CVE-2017-8801: Improper Neutralization of Input During Web Page Generation

Trend Micro OfficeScan 11.0 before SP1 CP 6325 with Agent Module Build before 6152 and XG before CP 1352 has XSS via a crafted URI using a blocked website...

Code injection

Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a leak of an encrypted password during a web-console operation...

CVE-2017-5481: Exposure of Sensitive Information to an Unauthorized Actor

Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a leak of an encrypted password during a web-console operation...

PT-2017-16522

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11.0 before SP1 CP 6325 Trend Micro OfficeScan XG before CP 1352 Description The issue allows remote authenticated users to gain privileges by leveraging a leak of an encrypted password during a web-console...