Trend Micro Security (Consumer) Buffer Error Vulnerability

Trend Micro Security Consumer is an antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Security 2021, 2022 versions 17.7.1383 and earlier, which stems from a susceptibility to an out-of-bounds read information disclosure vulnerability that can be exploited by an...

CVE-2022-34893: Improper Link Resolution Before File Access

Trend Micro Security 2022 consumer has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine...

CVE-2022-40980: Undefined Security Weakness

A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with access to the Management Server to delete files. This issue was resolved in 9.8 SP5 Critical Patch 2...

CVE-2022-40143: Improper Link Resolution Before File Access

A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbitrary code with elevated privileges. Please note: an attack...

CVE-2022-40142: Improper Privilege Management

A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local attacker to create a writable folder in an arbitrary location and escalate privileges on affected installations. Please note: an attacker mus...

CVE-2022-40141: Undefined Security Weakness

A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication strings that may contain some identification attributes of a particular Apex One server...

CVE-2022-40139: Undefined Security Weakness

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code executio...

CVE-2022-37348: Out-of-bounds Read

Trend Micro Security 2021 and 2022 Consumer is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the sa...

CVE-2022-37347: Out-of-bounds Read

Trend Micro Security 2021 and 2022 Consumer is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the sa...

PT-2022-25650

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security for Enterprise version 9.8 SP5 Description A potential unauthenticated file deletion issue could allow an attacker with access to the Management Server to delete files. Recommendations For Trend Micro Mobile Securit...

Trend Micro Mobile Security for Enterprise – Security Vulnerabilities

Trend Micro Mobile Security for Enterprise is a mobile antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Mobile Security for Enterprise 9.8 SP5. An attacker with administrative server access could exploit the vulnerability to delete files...

CVE-2022-40139

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code executio...

CVE-2022-40140: Origin Validation Error

An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2022-38764: Incorrect Default Permissions

A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder om the product installer...

PT-2022-25241 · Trend Micro · Trend Micro Apex One +1

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One and Apex One as a Service affected versions not specified Description: A vulnerability could allow an attacker to intercept and decode certain communication strings that may contain some identification attributes of a...

Trend Micro Security (Consumer) Buffer Error Vulnerability

Trend Micro Security Consumer is an antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Security 2021, 2022 versions 17.7.1383 and earlier, which stems from a susceptibility to an out-of-bounds read information disclosure vulnerability that can be exploited by an...

Researchers Find Link b/w PrivateLoader and Ruzki Pay-Per-Install Services

Cybersecurity researchers have exposed new connections between a widely used pay-per-install PPI malware service known as PrivateLoader and another PPI platform offered by a cybercriminal actor dubbed ruzki. "The threat actor ruzki aka les0k, zhigalsz advertises their PPI service on underground...

Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability

Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution...

Multiple vulnerabilities in Trend Micro Apex One and Trend Micro Apex One as a Service

Overview Trend Micro Apex One and Trend Micro Apex One as a Service provided by Trend Micro Incorporated contain multiple vulnerabilities listed below. Improper validation in some components of the rollback mechanism CWE-20 - CVE-2022-40139 Improper access control CWE-284 - CVE-2022-40140...

A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities

This blog entry details how Trend Micro Cloud One™ – Workload Security and Trend Micro Vision One™ effectively detected and blocked the abuse of the CVE-2020-14882 WebLogic vulnerability in affected endpoints...