Trend Micro InterScan Web Security Virtual Appliance VerboseLog Directory Traversal

A directory traversal vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance IWSVA. The vulnerability is due to improper validation of the HTTP request parameters when processing requests to the VerboseLog servlet. A remote, authenticated attacker can exploit this...

Trend Micro IWSVA PacFileManagement delete_pac_files Command Injection

A command injection vulnerability has been reported in Trend Micro InterScan Web Security Virtual Appliance IWSVA. The vulnerability exists due to improper validation of the HTTP request parameters when processing requests to the PacFileManagement servlet. A remote, authenticated attacker can...

Trend Micro IWSVA LogSettingHandler doPostMountDevice Command Injection

A command injection vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance IWSVA. The vulnerability exists due to improper validation of the HTTP request parameters when processing requests to the /rest/commonlog/logsetting/mountdevice URI. A remote, unauthenticated attacker...

Trend Micro Interscan Web Security Virtual Appliance (IWSVA) 6.5 SP2 XSS / Disclosure

Exploit Title: Trend Micro Interscan Web Security Virtual Appliance IWSVA 6.5.x Multiple Vulnerabilities Date: 12/01/2017 Exploit Author: SlidingWindow , Twitter: @KapilKhot Vendor Homepage: http://www.trendmicro.com/us/enterprise/network-security/interscan-web-security/virtual-appliance/ Version...

Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: Trend Micro Interscan Web Security Virtual Appliance IWSVA 6.5.x Multiple Vulnerabilities Date: 12/01/2017 Exploit Author: SlidingWindow , Twitter: @KapilKhot Vendor Homepage:...

Trend Micro IWSVA 6.5 < 6.5 Build 1746 Multiple Vulnerabilities

The version of Trend Micro InterScan Web Security Virtual Appliance IWSVA installed on the remote host is 6.5 prior to 6.5 Build 1746. It is, therefore, affected by multiple vulnerabilities : - Multiple access control issues exist that allow an authenticated, remote attacker with low privileges t...

CVE-2017-6340

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that...

Design/Logic Flaw

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that...

CVE-2017-6339

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority CA and dynamically generates digital certificates that are sent to client browsers to...

CVE-2017-6339

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority CA and dynamically generates digital certificates that are sent to client browsers to...

Design/Logic Flaw

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority CA and dynamically generates digital certificates that are sent to client browsers to...

CVE-2017-6340

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that...

CVE-2017-6340

CVE-2017-6340 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 prior to CP 1746. The issue is an XSS vulnerability in rest/commonlog/report/template name due to improper sanitization, compounded by weak access controls that let authenticated remote users with low privilege...

CVE-2017-6338

CVE-2017-6338 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746. Affected component/issue: multiple access control flaws that let an authenticated, low-privilege remote user (e.g., Reports Only or Auditor) modify FTP Access Control Settings, create/modify rep...

CVE-2017-6339

CVE-2017-6339 concerns Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746, where the product’s default CA behavior and certificate management allow an authenticated, low-privilege attacker to download the CA certificate and private key (default or uploaded) and decryp...

CVE-2017-6339

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority CA and dynamically generates digital certificates that are sent to client browsers to...

CVE-2016-9269

Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update...

CVE-2016-9269

Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update...

CVE-2016-9315

Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or ad...

Privilege escalation

Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or ad...