CVE-2023-25148

CVE-2023-25148 affects Trend Micro Apex One (on-premise) and related agent components. The vulnerability is a link-following issue in the Apex One agent that allows a local attacker to escalate privileges by changing a specific file into a pseudo-symlink, given the attacker already has low-privil...

CVE-2023-25148

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. Please note: an attacker must first obtain the ability to...

CVE-2023-25148

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. Please note: an attacker must first obtain the ability to...

CVE-2023-25147

An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on t...

CVE-2023-25147

CVE-2023-25147 affects Trend Micro Apex One agent. Affected component: Apex One agent during a specific update process, where a attacker with prior admin rights can bypass protection by using a crafted DLL. Impact aligns with confusion from multiple sources: local privilege escalation and protect...

CVE-2023-25147

An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on t...

CVE-2023-25146

CVE-2023-25146 is a local vulnerability in Trend Micro Apex One agent where a security agent link following flaw could let an attacker who already has low-privilege code execution quarantine a file, delete the original folder, and replace it with a junction to an arbitrary location, resulting in ...

CVE-2023-25146

A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder and replace with a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to an arbitrary location. Please note...

CVE-2023-25146

A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder and replace with a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to an arbitrary location. Please note...

CVE-2023-25145

CVE-2023-25145 describes a local privilege-escalation vulnerability in the Trend Micro Apex One agent, due to a link-following flaw in the scanning function. A local attacker with the ability to run low-privilege code can exploit this to escalate privileges on affected installations. The descript...

CVE-2023-25145

A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this...

CVE-2023-25144

An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary directories with arbitrary ownership...

CVE-2023-25144

Trend Micro Apex One shows a local privilege-escalation vulnerability (CVE-2023-25144) due to improper access control in the Apex One agent, enabling creation of arbitrary directories with arbitrary ownership. Affected component: Apex One agent; impact: elevated privileges. Remediation is availab...

CVE-2023-25144

An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary directories with arbitrary ownership...

CVE-2023-25143

Trend Micro Apex One is affected by CVE-2023-25143: an uncontrolled search path element in the Apex One Server installer could allow a remote attacker to achieve remote code execution. The issue is tied to the server installer, with impact on affected Trend Micro Apex One deployments. Public deta...

CVE-2023-25143

An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected products...

CVE-2023-25143

An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected products...

PT-2023-19936

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One Server affected versions not specified Description An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected...

CVE-2023-25147: Uncontrolled Search Path Element

An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on t...

CVE-2023-25148: Improper Link Resolution Before File Access

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. Please note: an attacker must first obtain the ability to...