Integer overflow

Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the process or achieve remote code execution...

Privilege escalation

A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on...

CVE-2022-24680

A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create a mount point and...

CVE-2022-24680

CVE-2022-24680 affects Trend Micro Apex One family (Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and related service agents). The root cause is a local privilege escalation in the NT Apex One RealTime Scan Service where an attacker can create a mount point, enabling arbi...

CVE-2022-24679

A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create an writable folder i...

CVE-2022-24679

CVE-2022-24679 concerns Trend Micro Apex One and related products (Apex One as a Service, WSB/Security Services agents). The vulnerability exists in the NT Apex One RealTime Scan Service: by abusing a DOS device redirection, a local attacker can create a writable folder in an arbitrary location a...

CVE-2022-24678

An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow an attacker to flood a temporary log locatio...

CVE-2022-24678

CVE-2022-24678 affects Trend Micro Apex One and related agents (Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Services). The vulnerability is a denial-of-service caused by resource exhaustion in the agent’s logging path: an attacker can flood a temporary log location by issuing...

CVE-2022-24671

A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on...

CVE-2022-24671

CVE-2022-24671 is a local privilege-escalation vulnerability in Trend Micro Antivirus for Mac. The flaw resides in the post-update handling (program_after_update) where an attacker can abuse symbolic links to modify a file during the update process, enabling privilege escalation to root if low-pr...

CVE-2022-25331

Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash the process...

CVE-2022-25331

CVE-2022-25331 describes uncaught exceptions in Trend Micro ServerProtect/ServerProtection (6.0/5.8 Information Server) that could allow a remote attacker to crash the process. Connected sources corroborate a remote-impact scenario. Some documents also note an underlying issue such as an integer ...

CVE-2022-25330

Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the process or achieve remote code execution...

CVE-2022-25330

CVE-2022-25330 concerns Trend Micro ServerProtect Information Server with integer overflow conditions in versions 6.0/5.8 that could permit a remote attacker to crash the process or achieve remote code execution. Connected sources corroborate an impact including remote code execution and DoS, tie...

CVE-2022-25329

Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An unauthenticated remote attacker with access to the Information Server could exploit this to register to the server and perform authenticated...

CVE-2022-25329

Summary: CVE-2022-25329 affects Trend Micro ServerProtect/Information Server. A hard-coded (static) credential is used for authentication when a specific console command is entered, allowing an unauthenticated remote attacker with access to register to the server and perform authenticated actions...

PT-2022-17217

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect versions 5.8 through 6.0 Description The issue is related to integer overflow conditions in the Trend Micro ServerProtect Information Server, which could allow a remote attacker to crash the process or achieve remote...

CVE-2022-24680: Improper Link Resolution Before File Access

A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create a mount point and...

CVE-2022-24678: Uncontrolled Resource Consumption

An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow an attacker to flood a temporary log locatio...

Vulnerabilities fixed in Trend Micro Server Protect

Trend Micro has fixed multiple vulnerabilities in Server Protect. The vulnerability with reference CVE-2022-25329 allows a remote malicious person to misuse a hardcoded password in order to perform administrative actions. perform. The other vulnerabilities allow an authenticated malicious person...