EUVD-2017-5604

Malware in sbrugna...

EUVD-2017-5602

Malware in sbrugna...

Trend Micro ScanMail for Exchange Log Query and Quarantine Query Page Cross-Site Scripting Vulnerability

Trend Micro ScanMail for Exchange is a mail firewall solution developed and maintained by Trend Micro that is designed to protect Exchange mail servers from viruses, spyware and spam threats. A cross-site scripting vulnerability exists in the Log Query and Quarantine Query pages in Trend Micro...

Trend Micro ScanMail for Exchange Security Restriction Bypass Vulnerability

Trend Micro ScanMail for Exchange is a mail firewall solution developed and maintained by Trend Micro that is designed to protect Exchange mail servers from viruses, spyware and spam threats. A security vulnerability exists in Trend Micro ScanMail for Exchange version 12.0, which arises from the...

CVE-2017-14090

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

CVE-2017-14092

The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

CVE-2017-14090

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

CVE-2017-14091

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources - could be exploited to overwrite sensitive files in the ScanMail for Exchange directory...

Cross site request forgery (csrf)

The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

Design/Logic Flaw

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

CVE-2017-14092: Cross-Site Request Forgery (CSRF)

The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

CVE-2017-14093: Improper Neutralization of Input During Web Page Generation

The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting XSS attacks...

CVE-2017-14090: Inadequate Encryption Strength

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

CVE-2017-14091: Insufficient Verification of Data Authenticity

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources - could be exploited to overwrite sensitive files in the ScanMail for Exchange directory...

CVE-2017-14090

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

CVE-2017-14091

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources - could be exploited to overwrite sensitive files in the ScanMail for Exchange directory...

CVE-2017-14093

Trend Micro ScanMail for Exchange 12.x (SMEX) contains a cross-site scripting vulnerability (CVE-2017-14093) in the Web-based Logs and Quarantine Query pages. The root cause is improper input handling on the logs/ Quarantine pages, allowing injected script via parameters such as optRemoteLog, txt...

PT-2017-13247

Name of the Vulnerable Software and Affected Versions Trend Micro ScanMail for Exchange version 12.0 Description The issue is related to the absence of Anti-CSRF tokens in the web interface forms of the affected software. This could allow an attacker to submit authenticated requests when an...

PT-2017-13245

Name of the Vulnerable Software and Affected Versions Trend Micro ScanMail for Exchange version 12.0 Description A vulnerability exists in Trend Micro ScanMail for Exchange where some communications to the update servers are not encrypted. Recommendations For version 12.0, ensure that all...

PT-2017-13248

Name of the Vulnerable Software and Affected Versions Trend Micro ScanMail for Exchange version 12.0 Description The issue concerns the Log Query and Quarantine Query pages, which are susceptible to cross-site scripting XSS attacks. This type of attack occurs when an application includes user inp...