Trend Micro Apex One Path Traversal Vulnerability

Trend Micro Apex One is an endpoint protection software from Trend Micro. Trend Micro Apex One suffers from a path traversal vulnerability, which arises when the program fails to properly filter for specific elements in the path of a resource or file, and can be exploited by an attacker to upload...

CVE-2023-36002

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-36002

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-35998

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before...

Authorization

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before...

CVE-2023-36002

CVE-2023-36002 affects Proofpoint Insider Threat Management Server prior to 7.14.3. A missing authorization check in multiple URL validation endpoints allows an anonymous attacker on an adjacent network to smuggle content via DNS lookups. Impact is limited to affected versions; mitigation is to u...

CVE-2023-36002 ITM Server Missing Authorization for URL validation

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-36002 ITM Server Missing Authorization for URL validation

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-36000

The CVE-2023-36000 entry concerns the Insider Threat Management Server (Proofpoint) where a missing authorization check in the MacOS agent configuration endpoint allows an adjacent-network attacker to obtain sensitive information after obtaining a valid agent authentication token. Affected versio...

CVE-2023-35998

CVE-2023-35998 concerns Proofpoint’s Insider Threat Management Server. The vulnerability is a missing authorization check in multiple SOAP endpoints, enabling an attacker on an adjacent network to read and write unauthorized objects after obtaining a valid agent authentication token. Affected all...

PT-2023-25410 · Unknown · Insider Threat Management Server

Name of the Vulnerable Software and Affected Versions: Insider Threat Management Server versions prior to 7.14.3 Description: A missing authorization check in the MacOS agent configuration endpoint enables an anonymous attacker on an adjacent network to obtain sensitive information. The attacker...

CVE-2023-32557

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges...

Path traversal

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges...

CVE-2023-32557

CVE-2023-32557 corresponds to a path traversal vulnerability in Trend Micro Apex One and Apex One as a Service that allows an unauthenticated attacker to upload an arbitrary file to the Management Server, enabling remote code execution with system privileges. The issue is documented across multip...

CVE-2023-32557

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges...

Design/Logic Flaw

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

CVE-2023-2993

Summary of CVE-2023-2993 (Mode C) CVE-2023-2993 affects Lenovo ThinkSystem components including SMM v1, SMM v2, and FPC. The vulnerability arises from authenticated, limited-privilege users being able to craft web management server API calls that execute a limited number of commands that the user...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

PT-2023-22482 · Fpc +1 · Fpc +1

Name of the Vulnerable Software and Affected Versions: SMM versions 1 and 2 FPC affected versions not specified Description: A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands that the...