Path traversal

A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console...

Remote code execution

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges...

Input validation

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges symlink attack which can lead to obtaining administrative privileges during the installation of the product...

Input validation

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-28581

CVE-2020-28581: A command injection in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 allows an authenticated, remote attacker to send crafted HTTP messages and execute arbitrary OS commands with elevated privileges. Multiple sources (NVD entry and Red Hat advisory...

CVE-2020-28581

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

CVE-2020-28579

Summary: CVE-2020-28579 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2. Multiple connected advisories describe a vulnerability that allows an authenticated, remote attacker to send a specially crafted HTTP message to achieve remote code execution with elevated privil...

CVE-2020-28579

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges...

CVE-2020-28580

A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

CVE-2020-28580

CVE-2020-28580 describes a command injection vulnerability in the AddVLANItem component of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2. An authenticated, remote attacker can send specially crafted HTTP messages to execute arbitrary OS commands with elevated privileges. The NVD en...

CVE-2020-28574

Trend Micro Worry-Free Business Security 10 SP1. The CVE describes an unauthenticated path traversal vulnerability that could allow an attacker to delete or modify arbitrary files on the product’s management console. The connected documents confirm the vulnerability type and impact but do not pro...

CVE-2020-28574

A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console...

CVE-2020-28578

CVE-2020-28578 affects Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2. Multiple connected sources describe a vulnerability where an unauthenticated remote attacker could send a specially crafted HTTP message and achieve remote code execution with elevated privileges, via a buffer ov...

CVE-2020-28578

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges...

CVE-2020-27697

CVE-2020-27697 : Trend Micro Security 2020 (Consumer) installer package vulnerable to a local privilege escalation via a symlink attack (placing a malicious DLL in an unprotected, high-privilege location) during installation. Multiple sources report this as a local elevation-of-privilege issue af...

CVE-2020-28572

Mode C: The provided documents describe a privilege-escalation issue in Trend Micro Apex One where an unprivileged user can abuse the product installer to reinstall the agent with additional malicious code, escalating to higher privileges. The affected product is Trend Micro Apex One; the vulnera...

CVE-2020-27697

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges symlink attack which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-28572

A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege...

CVE-2020-27695

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696

Summary of CVE-2020-27696 : Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that can be exploited by placing a specific Windows system directory, enabling elevation to administrator during product installation. The root cause is linked to the installer’s han...