Input validation

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

Command injection

A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

Path traversal

A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console...

Privilege escalation

A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege...

Input validation

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product...

Command injection

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

Remote code execution

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges...

Input validation

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges symlink attack which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-28581

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

CVE-2020-28581

CVE-2020-28581: A command injection in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 allows an authenticated, remote attacker to send crafted HTTP messages and execute arbitrary OS commands with elevated privileges. Multiple sources (NVD entry and Red Hat advisory...

CVE-2020-28579

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges...

CVE-2020-28580

CVE-2020-28580 describes a command injection vulnerability in the AddVLANItem component of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2. An authenticated, remote attacker can send specially crafted HTTP messages to execute arbitrary OS commands with elevated privileges. The NVD en...

CVE-2020-28580

A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

CVE-2020-28579

Summary: CVE-2020-28579 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2. Multiple connected advisories describe a vulnerability that allows an authenticated, remote attacker to send a specially crafted HTTP message to achieve remote code execution with elevated privil...

CVE-2020-28574

Trend Micro Worry-Free Business Security 10 SP1. The CVE describes an unauthenticated path traversal vulnerability that could allow an attacker to delete or modify arbitrary files on the product’s management console. The connected documents confirm the vulnerability type and impact but do not pro...

CVE-2020-28578

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges...

CVE-2020-28574

A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console...

CVE-2020-28578

CVE-2020-28578 affects Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2. Multiple connected sources describe a vulnerability where an unauthenticated remote attacker could send a specially crafted HTTP message and achieve remote code execution with elevated privileges, via a buffer ov...

CVE-2020-27697

CVE-2020-27697 : Trend Micro Security 2020 (Consumer) installer package vulnerable to a local privilege escalation via a symlink attack (placing a malicious DLL in an unprotected, high-privilege location) during installation. Multiple sources report this as a local elevation-of-privilege issue af...

CVE-2020-27697

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges symlink attack which can lead to obtaining administrative privileges during the installation of the product...