CVE-2018-6229

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

CVE-2018-6226

CVE-2018-6226 affects Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) and documents multiple web-UI vulnerabilities. The connected sources describe cross-site scripting flaws in keymanserverconfig.jsp and mimebuilderconfig.jsp (parameters like keyAge, deniedKeysExpireTimeout, encryptionX...

CVE-2018-6223

A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate the registration process of the product to reset configuration parameters...

CVE-2018-6224

CVE-2018-6224 relates to Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) and describes a lack of anti-CSRF protection in the web interface. The vulnerability allows an attacker to cause authenticated actions in a user’s session when the user visits a malicious domain, due to CSRF protect...

CVE-2018-6225

An XML external entity injection XXE vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protected configuration script...

Sharing research and discoveries at PWN2OWN

The annual PWN2OWN exploit contest at the CanSecWest conference in Vancouver, British Columbia, Canada, brings together some of the top security talent from across the globe in a friendly competition. For the participants, these events are a platform to demonstrate world-class skills and vie for...

A View of Upcoming Threat Coverage from Pwn2Own 2018

This blog will be updated throughout the competition so keep tracking for the latest updates on upcoming threat coverage! St. Patrick’s Day is coming up later this week, but the contestants at Pwn2Own 2018 will need more than luck on their side. They will need to dive into their expert hacking...

Trend Micro Smart Protection Server Encryption Key Disclosure

Encryption key disclosure vulnerability in rend Micro Smart Protection Server Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 5, 2018

Today marks the first day of South by Southwest SXSW here in Austin and if you happen to be in town for the event, Trend Micro will be there! Starting tomorrow, Trend Micro will be exhibiting at the SXSW Job Market in booth 523. The SXSW Job Market is being held on March 10-11, 2018 at the Palmer...

Trend Micro Smart Protection Server Session Hijacking Via Log File Disclosure

The Trend Micro Smart Protection Server running on the remote host is affected by a session hijacking vulnerability due to the disclosure of session IDs in the diagnostic.log file that can be accessed via HTTP without authentication. An unauthenticated, remote attacker can grab the log file and...

Trend Micro Smart Protection Server Detection

Binary data trendmicrosmartprotectionserverdetect.nbin...

Trend Micro at HiMSS: Protecting Healthcare Organizations with Optimized, Connected Security

Submitted by Elie Nasrallah , Director – Cyber Security Strategy The healthcare industry remains one of the most frequently targeted sectors in the United States. It accounted for nearly a quarter 23% of all breaches reported in 2017, second only to the business category, in another record year f...

Delta Electronics Delta Industrial Automation DOPSoft

CVSS v3 6.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Delta Electronics Equipment: Delta Industrial Automation DOPSoft Vulnerability: Stack-based Buffer Overflow AFFECTED PRODUCTS The following version of Delta Industrial Automation DOPSoft, a human machine interface HMI...

VPN 101 – Part 2: How to Set Up the VPN/Content Shield in Trend Micro Mobile Security for iOS

Submitted by Brook Stein When you use Content Shield in Trend Micro Mobile Security for iOS, you’re protected from web threats across all iOS browsers and in apps that load websites. If you activate Age filters for your family members, they’re also protected from going to inappropriate websites...

Trend Micro Smart Protection Server Auth Command Injection Authentication Bypass Vulnerability

This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Trend Micro Smart Protection Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of credentials provided at login. When parsing the...

A Tea Party with a Difference: Trend Micro Supports Arts and Cultural Education in Rural Taiwan

Trend Micro has been at the cutting edge of technology innovation for almost 30 years. During that time, we’ve always had to have a keen eye on what’s coming next — anticipating threats so we can keep our customers protected, whatever comes their way. But we also recognize that in our race for th...

Delta Electronics WPLSoft

CVSS v3 8.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Delta Electronics Equipment: WPLSoft Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Out-of-bounds Write. AFFECTED PRODUCTS The following versions of WPLSoft, a PLC programming software, are...

Trend Micro Maximum Security Regex Matching Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Maximum Security. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 19, 2018

Earlier this week, Trend Micro released its Security Roundup for 2017, which reveals an increase in ransomware, cryptocurrency mining and business email compromise BEC attempts over the past year as cybercriminals refined and targeted their attacks for greater financial return. Surprisingly, some...

This Week in Security News: Bank Robberies and Whaling

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, business leaders share their tips on keeping their companies safe, hackers stole from a Russian central bank, and Google reveals a new...