CVE-2023-35695: Insertion of Sensitive Information into Log File

A remote attacker could leverage a vulnerability in Trend Micro Mobile Security Enterprise 9.8 SP5 to download a particular log file which may contain sensitive information regarding the product...

CVE-2023-30902: Incorrect Default Permissions

A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privileged Trend Micro registry keys including its own protected registry keys on affected installations...

CVE-2023-32605: Improper Neutralization of Input During Web Page Generation

Affected versions Trend Micro Apex Central on-premise are vulnerable to potential authenticated reflected cross-site scripting XSS attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order ...

CVE-2023-32524: Improper Authentication

Affected versions of Trend Micro Mobile Security Enterprise 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obtain the ability to execute low-privileged code on the target...

Trend Micro Mobile Security for Enterprise 路径遍历漏洞

Trend Micro Mobile Security for Enterprise is a mobile antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Mobile Security for Enterprise version 9.8 SP5, which originates from a path traversal vulnerability that could allow an unauthenticated attacker to delete...

PT-2023-23034 · Trend Micro · Trend Micro Apex One +1

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Trend Micro Apex One as a Service affected versions not specified Description: A privilege escalation issue could allow a local attacker to unintentionally delete privileged Trend Micro...

Trend Micro Apex Central 跨站脚本漏洞

Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. A cross-site scripting vulnerability exists in Trend Micro Apex Central, which can be exploited by an attacker to inject malicious script or HTML code...

CVE-2023-32536: Improper Neutralization of Input During Web Page Generation

Affected versions Trend Micro Apex Central on-premise are vulnerable to potential authenticated reflected cross-site scripting XSS attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order ...

CVE-2023-32530: Improper Neutralization of Special Elements used in an SQL Command

Vulnerable modules of Trend Micro Apex Central on-premise contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution. Please note: an attacker must first obtain authentication on the target system in order to exploit these...

CVE-2023-32529: Improper Neutralization of Special Elements used in an SQL Command

Vulnerable modules of Trend Micro Apex Central on-premise contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution. Please note: an attacker must first obtain authentication on the target system in order to exploit these...

CVE-2023-32528: Improper Control of Generation of Code

Trend Micro Mobile Security Enterprise 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this...

CVE-2023-32534: Improper Neutralization of Input During Web Page Generation

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535...

CVE-2023-32527: Improper Control of Generation of Code

Trend Micro Mobile Security Enterprise 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this...

Trend Micro Mobile Security for Enterprise 授权问题漏洞

Trend Micro Mobile Security for Enterprise is a mobile antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Mobile Security for Enterprise version 9.8 SP5, which originated from a vulnerability that allows an attacker to bypass authentication...

CVE-2023-32604: Improper Neutralization of Input During Web Page Generation

Affected versions Trend Micro Apex Central on-premise are vulnerable to potential authenticated reflected cross-site scripting XSS attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order ...

Trend Micro Apex Central 跨站脚本漏洞

Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. A cross-site scripting vulnerability exists in Trend Micro Apex Central, which can be exploited by an attacker to inject malicious script or HTML code...

Trend Micro Apex One 代码问题漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro. An elevation of privilege vulnerability exists in Trend Micro Apex One, which can be exploited by a local attacker to elevate privileges...

CVE-2023-32533: Improper Neutralization of Input During Web Page Generation

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535...

Trend Micro Apex Central SQL注入漏洞

Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. Trend Micro Apex Central suffers from an SQl injection vulnerability that can be exploited by an attacker to submit a specially crafted SQL request to manipulate the database, obtain sensitive information or execute arbitrary...

CVE-2023-32521: Improper Limitation of a Pathname to a Restricted Directory

A path traversal exists in a specific service dll of Trend Micro Mobile Security Enterprise 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files...