CVE-2012-2998

SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager TMCM before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-2998

Affected product: Trend Micro Control Manager (TMCM). Vulnerable component: Ad hoc query module (AdHocQuery_Processor.aspx path, AdHocQuery.NET.dll scope in TMCM). Root cause: SQL injection in the ad hoc query module. Impact: Remote attackers could execute arbitrary SQL commands against the backe...

CVE-2012-2998: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager TMCM before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2012-4423

Name of the Vulnerable Software and Affected Versions Trend Micro Control Manager versions prior to 5.5.0.1823 Trend Micro Control Manager version 6.0 before 6.0.0.1449 Description A SQL injection issue exists in the ad hoc query module, allowing remote attackers to execute arbitrary SQL commands...

Trend Micro Control Manager vulnerable to SQL injection

Overview Trend Micro Control Manager contains a SQL injection vulnerability. Trend Micro Control Manager contains a vulnerability in the ad hoc query module, which may result in SQL injection. Tom Gregory and Mada R Perdhana of Spentera reported this vulnerability to JPCERT/CC. JPCERT/CC...

Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection (post-auth)

Exploit for asp platform in category web applications !/usr/bin/env python Exploit Title: Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection post-auth Disclosure Date: 09/27/2012 Author: otoy @otoyrood & modpr0be @modpr0be Contact: researchatspentera.com Platform: Windows Tested on...

Trend Micro Control Manager 5.5 / 6.0 Blind SQL Injection

!/usr/bin/env python Exploit Title: Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection post-auth Disclosure Date: 09/27/2012 Author: otoy @otoyrood & modpr0be @modpr0be Contact: researchatspentera.com Platform: Windows Tested on: Windows 2003 Standard Edition Software Link:...

Trend Micro Control Manager 5.56.0 AdHocQuery - (Authenticated) Blind SQL Injection

Trend Micro Control Manager 5.56.0 AdHocQuery - Authenticated Blind SQL Injection !/usr/bin/env python Exploit Title: Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection post-auth Disclosure Date: 09/27/2012 Author: otoy @otoyrood & modpr0be @modpr0be Contact: researchatspentera.com...

JVN#42014489: Trend Micro Control Manager vulnerable to SQL injection

Trend Micro Control Manager contains a vulnerability in the ad hoc query module, which may result in SQL injection. Impact An arbitrary SQL command may be executed in the backend database the product is referencing. Solution Apply a patch Apply the appropriate patch according to the information...

Trend Micro Control Manager adhoc query vulnerability

Overview Trend Micro Control Manager fails to properly filter user-supplied input within the ad hoc query module which could allow an attacker to upload and execute arbitrary code against the system. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL...

Trend Micro Control Manager 5.5/6.0 AdHocQuery - (Authenticated) Blind SQL Injection

!/usr/bin/env python Exploit Title: Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection post-auth Disclosure Date: 09/27/2012 Author: otoy @otoyrood & modpr0be @modpr0be Contact: researchatspentera.com Platform: Windows Tested on: Windows 2003 Standard Edition Software Link:...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-BuildWin321394 allow remote attackers to inject arbitrary web script or HTML via 1 the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or 2 the src parameter to initUpdSchPage.imss...

CVE-2012-2995

Multiple cross-site scripting XSS vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-BuildWin321394 allow remote attackers to inject arbitrary web script or HTML via 1 the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or 2 the src parameter to initUpdSchPage.imss...

CVE-2012-2996

Cross-site request forgery CSRF vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-BuildWin321394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-BuildWin321394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action...

CVE-2012-2995

CVE-2012-2995 describes cross-site scripting vulnerabilities in Trend Micro InterScan Messaging Security Suite version 7.1-Build_Win32_1394. The stored XSS can be triggered via wrsApprovedURL in addRuleAttrWrsApproveUrl.imss, while non-persistent/reflected XSS can be triggered via src in initUpdS...

CVE-2012-2996

Cross-site request forgery CSRF vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-BuildWin321394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action...

CVE-2012-2995

Multiple cross-site scripting XSS vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-BuildWin321394 allow remote attackers to inject arbitrary web script or HTML via 1 the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or 2 the src parameter to initUpdSchPage.imss...

CVE-2012-2996

CVE-2012-2996 affects Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394. The vulnerability is a Cross-Site Request Forgery (CSRF) in saveAccountSubTab.imss that enables exploitation via a saveAuth action to hijack administrator authentication and create new admin accounts. Root ...

CVE-2012-2995: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-BuildWin321394 allow remote attackers to inject arbitrary web script or HTML via 1 the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or 2 the src parameter to initUpdSchPage.imss...