CVE-2024-41183

Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges...

CVE-2024-41183

CVE-2024-41183 affects Trend Micro VPN/VPN Proxy One Pro. Concrete details in connected sources show a local-privilege-escalation via arbitrary file overwrite in the DEP Manager (for Trend Micro VPN Proxy One Pro) and a similar path in VpnBackgroundController for Trend Micro VPN Proxy One Pro. Af...

CVE-2024-39753

CVE-2024-39753 involves a modOSCE SQL Injection in Trend Micro Apex One (and Apex One as a Service) that can lead to remote code execution. Affected component is the client management functionality; the vulnerability arises from unsafely built SQL queries using untrusted input. Exploitation requi...

CVE-2024-39753

An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

CVE-2024-39753

An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining...

Multiple SQL injection vulnerabilities in Trend Micro Deep Discovery Inspector

Overview Trend Micro Incorporated has released a security update for Trend Micro Deep Discovery Inspector. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. Impact Information disclosure due to multiple SQL injection vulnerabilities...

Trend Micro Deep Security Agent 安全漏洞

Trend Micro Deep Security Agent is a security solution from Trend Micro, Inc. that is primarily used to protect data and applications in servers, virtual machines, and cloud environments. A security vulnerability exists in versions prior to Trend Micro Deep Security Agent 20.0.1-17380, which stem...

Trend Micro Cloud Edge 命令注入漏洞

Trend Micro Cloud Edge is a cloud security solution from Trend Micro designed to protect an organization's cloud infrastructure, applications and data. A security vulnerability exists in Trend Micro Cloud Edge versions 5.6SP2 and 7.0 that stems from the presence of a command injection vulnerabili...

CVE-2024-48903: Improper Privilege Management

An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this...

CVE-2024-45335: Processor Optimization Removal or Modification of Security-critical Code

Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted virus to allow itself to bypass and evade a virus scan detection...

CVE-2024-45334: Improper Access Control

Trend Micro Antivirus One versions 3.10.4 and below Consumer is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to product configurations and functions...

CVE-2024-41183: External Control of File Name or Path

Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges...

Trend Micro VPN 安全漏洞

Trend Micro VPN is a best-of-breed virtual private network service from Trend Micro. A security vulnerability exists in Trend Micro VPN version 5.8.1012 and prior versions, which stems from a vulnerability to arbitrary file overwriting under certain conditions, resulting in elevated privileges...

Trend Micro Apex One和Trend Micro Apex One as a Service SQL注入漏洞

Trend Micro Apex One and Trend Micro Apex One as a Service are both products of Trend Micro, Inc.Trend Micro Apex One is an endpoint protection software.Trend Micro Apex One as a Service is an Trend Micro Apex One as a Service is an enhanced endpoint security solution. A security vulnerability...

Trend Micro Antivirus One 安全漏洞

Trend Micro Antivirus One is an antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Antivirus One version 3.10.4 and prior versions, which stems from vulnerability to an arbitrary configuration update attack that could allow unauthorized access to product...

Trend Micro Deep Discovery Inspector SQL注入漏洞

Trend Micro Deep Discovery Inspector is a physical or virtual network appliance from Trend Micro that monitors networks in 360 degrees. A security vulnerability exists in Trend Micro Deep Discovery Inspector version 5.8 and earlier, which originated from a vulnerability that allows an attacker to...

CVE-2024-46903: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Trend Micro Deep Discovery Inspector DDI versions 5.8 and above could allow an attacker to disclose sensitive information affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this...

CVE-2024-39753: Improper Neutralization of Special Elements used in an SQL Command

An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

CVE-2024-48904: Improper Neutralization of Special Elements used in a Command

An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: authentication is not required in order to exploit this vulnerability...