CVE-2016-9315

CVE-2016-9315 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 and earlier. The issue is a privilege-escalation in the com.trend.iwss.gui.servlet.updateaccountadministration servlet, where an authenticated, low-privilege user can change the Master Admin password or add new...

CVE-2016-9269

CVE-2016-9269 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5.x before Build 1737. The vulnerability lies in the ManagePatches servlet (com.trend.iwss.gui.servlet.ManagePatches) where insecure access controls during patch updates allow an authenticated, remote user with l...

CVE-2016-9314

Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to backup the system configuration and download it onto thei...

CVE-2016-9316

Trend Micro IWSVA 6.5.x before Build 1737 is affected by CVE-2016-9316 due to improper validation in the updateaccountadministration servlet, allowing authenticated remote attackers with minimal privileges to trigger stored XSS via accountnamelocal/description parameters. Impact per sources is st...

CVE-2016-9316

Multiple stored Cross-Site-Scripting XSS vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary...

Trend Micro InterScan Arbitrary File Write Vulnerability

Trend Micro InterScan Web Security Virtual Appliance is a Trend Micro Web Security Gateway that provides plug-and-play protection against Web threats. An arbitrary file write vulnerability exists in Trend Micro InterScan that can be exploited by an attacker to gain privileges...

PT-2017-10052

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance IWSVA versions prior to 6.5 CP 1737 Description A privilege escalation issue allows authenticated, remote users with least privileges to change the Master Admin's password and/or add new adm...

CVE-2016-9315: Undefined Security Weakness

Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or ad...

CVE-2016-9314: Exposure of Sensitive Information to an Unauthorized Actor

Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to backup the system configuration and download it onto thei...

CVE-2016-9316: Improper Neutralization of Input During Web Page Generation

Multiple stored Cross-Site-Scripting XSS vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary...

CVE-2016-9269: Undefined Security Weakness

Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update...

PT-2017-10053

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance IWSVA versions prior to 6.5 CP 1737 Description The issue allows authenticated, remote users with least privileges to inject arbitrary HTML/JavaScript code into web pages due to multiple...

PT-2017-10051

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance IWSVA versions prior to 6.5 CP 1737 Description The issue allows authenticated, remote users with least privileges to backup the system configuration and download it onto their local machine...

PT-2017-10036

Name of the Vulnerable Software and Affected Versions Trend Micro Interscan Web Security Virtual Appliance IWSVA versions 6.5-SP2 Build Linux 1707 and earlier Description The issue allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch...

Trend Micro InterScan Web Security Virtual Appliance Elevation of Privilege Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. An elevation of privilege vulnerability exists in Trend Micro IWSVA version 6.5. An attack...

Trend Micro InterScan Web Security Virtual Appliance Remote Code Execution Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A remote command execution vulnerability exists in Trend Micro IWSVA version 6.5. The...

Trend Micro InterScan Web Security Virtual Appliance Information Disclosure Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A sensitive information disclosure vulnerability exists in Trend Micro IWSVA version 6.5...

Trend Micro Control Manager download.php File Disclosure

The version of Trend Micro Control Manager running on the remote host is affected by a file disclosure vulnerability due to a failure to properly sanitize user-supplied input to the download.php script. An unauthenticated, remote attacker can exploit this, via a crafted request employing director...

Trend Micro Control Manager Detection (uncredentialed)

Binary data trendmicrocontrolmanagerdetectunauth.nbin...

Trend Micro InterScan Web Security Virtual Appliance 6.5 Multiple Vulnerabilities

Trend Micro has released a new build of Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5. This build resolves vulnerabilities in the product that could potentially allow a remote attacker to execute artibtrary code on vulnerable installations. SPDX-FileCopyrightText: 2017 Greenbone ...