CVE-2020-28572

Mode C: The provided documents describe a privilege-escalation issue in Trend Micro Apex One where an unprivileged user can abuse the product installer to reinstall the agent with additional malicious code, escalating to higher privileges. The affected product is Trend Micro Apex One; the vulnera...

CVE-2020-28572

A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege...

CVE-2020-27695

CVE-2020-27695 affects Trend Micro Security 2020 (Consumer) and is described as a local elevation-of-privilege vulnerability in the product’s installer. The issue involves placing a malicious DLL in a local directory, which could lead to administrative privileges during installation. Connected so...

CVE-2020-27696

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27695

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696

Summary of CVE-2020-27696 : Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that can be exploited by placing a specific Windows system directory, enabling elevation to administrator during product installation. The root cause is linked to the installer’s han...

PT-2020-17020

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 Description A command injection issue in the AddVLANItem function could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary ...

PT-2020-16772

Name of the Vulnerable Software and Affected Versions Trend Micro Security 2020 Consumer affected versions not specified Description The issue concerns a vulnerability in the installer package of the software. This vulnerability can be exploited by placing a specific file in a Windows system...

PT-2020-17021

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 Description A command injection issue in ModifyVLANItem could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS command...

PT-2020-16773

Name of the Vulnerable Software and Affected Versions Trend Micro Security 2020 Consumer Description The issue concerns a vulnerability in the installer package that can be exploited through a symlink attack. This involves placing a malicious DLL in a non-protected location with high privileges,...

PT-2020-16771

Name of the Vulnerable Software and Affected Versions Trend Micro Security 2020 Consumer Description The issue concerns a vulnerability in the installer package of the software. This vulnerability can be exploited by placing a malicious DLL in a local directory, potentially leading to the...

CVE-2020-28579: Out-of-bounds Write

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges...

CVE-2020-27697: Improper Link Resolution Before File Access

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges symlink attack which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696: Undefined Security Weakness

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27695: Untrusted Search Path

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-28580: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

CVE-2020-28572: Undefined Security Weakness

A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege...

Trend Micro InterScan Web Security Virtual Appliance Command Injection Vulnerability (CNVD-2021-08543)

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance...

CVE-2020-28574: Improper Limitation of a Pathname to a Restricted Directory

A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console...

CVE-2020-28581: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...