CVE-2017-6339

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority CA and dynamically generates digital certificates that are sent to client browsers to...

CVE-2017-6338

CVE-2017-6338 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746. Affected component/issue: multiple access control flaws that let an authenticated, low-privilege remote user (e.g., Reports Only or Auditor) modify FTP Access Control Settings, create/modify rep...

CVE-2017-6340

CVE-2017-6340 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 prior to CP 1746. The issue is an XSS vulnerability in rest/commonlog/report/template name due to improper sanitization, compounded by weak access controls that let authenticated remote users with low privilege...

CVE-2017-6339

CVE-2017-6339 concerns Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746, where the product’s default CA behavior and certificate management allow an authenticated, low-privilege attacker to download the CA certificate and private key (default or uploaded) and decryp...

PT-2017-17005

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance IWSVA versions 6.5 before CP 1746 Description The issue concerns Access Control problems, allowing an authenticated, remote user with low privileges, such as Reports Only or Auditor, to...

PT-2017-17006

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance IWSVA versions 6.5 before CP 1746 Description The issue concerns the mismanagement of key and certificate data. By default, IWSVA acts as a private Certificate Authority CA and generates...

CVE-2017-6338: Incorrect Permission Assignment for Critical Resource

Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 allow an authenticated, remote user with low privileges like 'Reports Only' or 'Auditor' to change FTP Access Control Settings, create or modify reports, or upload an HTTPS Decryption...

Trend Micro Smart Protection Server wcs_bwlists_handler Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Smart Protection Server. Authentication is required to exploit this vulnerability. The specific flaw exists within wcsbwlistshandler.php. The issue results from the lack of proper...

Trend Micro Control Manager cgiShowClientAdm Missing Authentication for Critical Function Vulnerability

This vulnerability allows remote attackers to modify the security posture of the underlying product on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the...

Trend Micro Enterprise Mobile Security Android Application Man-in-the-Middle Attack Vulnerability

Trend Micro Enterprise Mobile Security Android Application is a mobile security suite. Versions of Trend Micro Enterprise Mobile Security Android Application prior to 9.7.1193 lack SSL certificate validation, which could allow an attacker to perform a man-in-the-middle attack and present a forged...

PT-2017-17007

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance IWSVA versions 6.5 before CP 1746 Description The issue concerns a lack of sanitization in a report/template name field, allowing a user with 'Reports Only' access to inject malicious...

CVE-2017-6340: Improper Neutralization of Input During Web Page Generation

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that...

CVE-2017-6339: Improper Privilege Management

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority CA and dynamically generates digital certificates that are sent to client browsers to...

Design/Logic Flaw

There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398...

CVE-2016-9319

There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398...

CVE-2016-9319

There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398...

PT-2017-10054

Name of the Vulnerable Software and Affected Versions Trend Micro Enterprise Mobile Security versions prior to 9.7.1193 Description The issue concerns a missing SSL certificate validation in the Android application. Recommendations For versions prior to 9.7.1193, update to version 9.7.1193 or lat...

CVE-2016-9319: Improper Certificate Validation

There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398...

CVE-2016-9319

There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398...

CVE-2016-9319

The CVE-2016-9319 entry concerns Trend Micro Enterprise Mobile Security for Android. Connected sources confirm that versions prior to 9.7.1193 lack SSL certificate validation, enabling potential Man-in-the-Middle attacks (MITM) by presenting forged certificates (VRTS-398). Impact is described as ...