CVE-2017-9036: Missing Authorization

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory...

CVE-2017-9033: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoptionset.cgi, related to the...

CVE-2017-9034: Improper Input Validation

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges by leveraging failure to validate software updates...

CVE-2017-9035: Cleartext Transmission of Sensitive Information

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers...

PT-2017-18657

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux version 3.0 before CP 1531 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests to start an update from any source via a crafted request to...

PT-2017-18658

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux versions 3.0 before CP 1531 Description The issue allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers. Recommendations For Trend Micro...

PT-2017-18656

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux version 3.0 before CP 1531 Description The issue allows remote attackers to inject arbitrary web script or HTML via the T1 or tmLastConfigFileModifiedDate parameter to the "log management.cgi" API endpoint...

PT-2017-18659

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux version 3.0 before CP 1531 Description The issue allows local users to gain privileges by leveraging an unrestricted quarantine directory. Recommendations For Trend Micro ServerProtect for Linux version 3.0...

PT-2017-18660

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux version 3.0 before CP 1531 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters to the notification.cgi endpoint, including S44, S5, S action fail, S p...

Custom 32-Bit Cursors appear with a black box around them using HDX 3D Pro VDA 7.15

When connecting to an HDX3D Pro Desktop VDA from a client running Receiver for Linux, a black box will surround some custom cursors in applications such as Adobe Photoshop...

PT-2017-8705

Name of the Vulnerable Software and Affected Versions Symantec Advanced Threat Protection: Network ATP affected versions not specified Symantec Email Security.Cloud affected versions not specified Symantec Data Center Security: Server affected versions not specified Symantec Endpoint Protection S...

PT-2017-2285

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus 8.0 for Linux File Servers Description The issue is related to a cross-site scripting vulnerability in the web console of Kaspersky Anti-Virus 8.0 for Linux File Servers. An attacker can exploit this by sending a specially...

PT-2017-2895

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue concerns a cross-site scripting XSS vulnerability related to the scriptName parameter of the licenseKeyInfo action method. This vulnerability can be...

PT-2017-2286

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus 8.0 for Linux File Servers Description The issue is related to a potential command injection vulnerability in the web console of the antivirus software. This could allow a remote attacker to access a file on the server by...

PT-2017-2844

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue exists due to insufficient input validation during quarantine read and write operations in the kav4fs-control service. This can be exploited by a remo...

PT-2017-2283

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus 8.0 for Linux File Servers Description The issue is caused by a lack of authentication check for web console form creators in Kaspersky Anti-Virus 8.0 for Linux File Servers. This could allow a remote attacker to send a...

PT-2017-2933

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the absence of Anti-CSRF tokens in all forms on the web interface of Kaspersky Anti-Virus for Linux File Server. This could allow a remo...

PT-2017-2932

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the reportId parameter of the getReportStatus action method in the web interface, which can be exploited to read arbitrary files with...

PT-2017-2284

Name of the Vulnerable Software and Affected Versions Antivirus Kaspersky 8.0 for Linux File Servers Description The issue is related to insecure privilege management in the web console of Antivirus Kaspersky 8.0 for Linux File Servers. An attacker with non-privileged user rights, specifically th...

PT-2017-2910

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux version 3.0 before CP 1531 Description The issue exists due to insufficient input validation, allowing a remote attacker to modify arbitrary files or execute arbitrary code with root privileges by exploiting...