Trend Micro Identified as a Representative Vendor for its Protection Capabilities For Cloud Workloads

We are proud to be included in this year’s Gartner Market Guide for Cloud Workload Protection Platforms report, which included 24 security leaders in Cloud Workload Protection solutions. Trend Micro was identified with 16 out of 21 capabilities listed by Gartner. Trend Micro delivers unique serve...

Trend Micro OfficeScan Proxy.php Command Injection (CVE-2017-11394)

A command injection vulnerability exists in Trend Micro's OfficeScan. The vulnerability is due to improper validation of HTTP parameters within the Proxy.php script. A remote, authenticated attacker could exploit the vulnerability by sending a crafted request to the vulnerable system...

Advantech WebOP

CVSS v3 4.8 ATTENTION: Low skill level to exploit. Public exploits are available. Vendor: Advantech Equipment: WebOP Vulnerability: Heap-Based Buffer Overflow AFFECTED PRODUCTS Researchers report that all versions of Advantech WebOP operator panels are affected. IMPACT Successful exploitation of...

Amazon Macie and Deep Security

Amazon S3 stores trillions of objects and regularly peaks at millions of requests per second. By any metric, it’s massive. With unparalleled durability and availability, it’s the backbone of AWS’ data services. This morning at the AWS Summit in New York City, AWS launched a new service: Amazon...

How Just Opening A Malicious PowerPoint File Could Compromise Your PC

A few months back we reported how opening a simple MS Word file could compromise your computer using a critical vulnerability in Microsoft Office. The Microsoft Office remote code execution vulnerability CVE-2017-0199 resided in the Windows Object Linking and Embedding OLE interface for which a...

Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection (CVE-2017-11384)

An SQL injection vulnerability exists in Trend Micro Control Manager. The vulnerability is due to improper validation of the user-supplied input for cmdHandlerLicenseManager.dll. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server...

Trend Micro SafeSync for Enterprise dead_local_device Command Injection

A command injection vulnerability exists in Trend Micro's SafeSync for Enterprise. The vulnerability is due to insufficient validation of the user-supplied parameters in the deadlocaldevice function. A remote, authenticated attacker could exploit this vulnerability by sending a crafted request to...

Hackers Leverage Chat for Command&Control: How You Can Protect Your Business

Chat platforms have become a cornerstone for businesses and their customers alike. These important tools make it possible for employees to communicate and collaborate from nearly any location, and enable consumers to reach out to companies in accordance with their preferences. This fondness for...

The vulnerability of the Proxy.php proxy server of the Trend Micro Anti-Virus protection system allows a hacker to execute arbitrary code.

The vulnerability of the Proxy.php proxy server of the Trend Micro Anti-Virus protection system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code upon processing the tr parameter...

CVE-2016-6220

Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0...

Information disclosure

Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0...

CVE-2016-6220

Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0...

CVE-2016-6220

CVE-2016-6220 affects Trend Micro Control Manager SP3 6.0; a vulnerability in the Dashboard and Error Pages allows information disclosure over the network. CVSS-3.1 base score 7.5 (HIGH) with no privileges required and no user interaction, impacting confidentiality (HIGH) but not integrity/availa...

Cybersecurity Wants You!

At Black Hat in Las Vegas last week, Trend Micro’s Kevin Simzer spoke about the global, dire need for cybersecurity talent. The number of open jobs in cybersecurity continues to increase dramatically. A report from Cisco stated that there were over one million unfilled positions globally in 2016...

Trend Micro InterScan Messaging Security Virtual Appliance Command Injection Vulnerability (CNVD-2017-21035)

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA is an email gateway security appliance from Trend Micro that integrates anti-virus, anti-spyware and anti-phishing technologies to provide comprehensive protection for email applications. A command injection vulnerability exists in...

Trend Micro OfficeScan Command Injection Vulnerability

Trend Micro OfficeScan is a suite of distributed anti-virus software from Trend Micro. A command injection vulnerability exists in Trend Micro OfficeScan version 11 and XG 12. A remote attacker could exploit this vulnerability to execute arbitrary code...

CVE-2017-11391

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744...

CVE-2017-11394

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544...

CVE-2017-11392

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745...

CVE-2017-11391

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744...