Rogue Trend Micro Employee Sold Customer Data for 68K Accounts

Trend Micro said that a rogue employee sold the data of 68,000 customers to a malicious third party, who then used that data to target customers with scam calls. The employee, who gained unauthorized access to a customer-support database, has since been terminated. Trend Micro said that the...

Multiple Trend Micro Products Multiple Security Vulnerabilities

Description Multiple Trend Micro Products are prone to the following security vulnerabilities: 1. An information-disclosure vulnerability 2. An arbitrary file-deletion vulnerability An attacker can exploit this issue to obtain sensitive information or delete arbitrary files from the affected...

Tips to Accelerating PCI Data Security Standard Projects with Deep Security as a Service

Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...

Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus HPE Data Protector SUID Privilege Escalation', 'Description' = %q This module exploits the trusted $PATH environment variable of the...

Micro Focus (HPE) Data Protector SUID Privilege Escalation Exploit

This Metasploit module exploits the trusted $PATH environment variable of the SUID binary omniresolve in Micro Focus HPE Data Protector versions A.10.40 and below. The omniresolve executable calls the oracleasm binary using a relative path and the trusted environment $PATH, which allows an attack...

This Week in Security News: Pwn2Own Adds Industrial Control Systems to Hacking Contest and Cyber Crooks Target ESports

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Among news from this week, learn about Pwn2Own’s new hacking contest that will take place in Miami next year. Also, as October was Cybersecurity...

Micro Focus (HPE) Data Protector SUID Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus HPE Data Protector SUID Privilege Escalation', 'Description' = %q This module exploits the trusted $PATH environment variable of the...

Trend Micro OfficeScan Path Traversal Vulnerability

Trend Micro OfficeScan is a suite of distributed anti-virus software from Trend Micro. A path traversal vulnerability exists in Trend Micro OfficeScan version 11.0 and XG 12.0, which arises from a failure of a networked system or product to properly filter for specific elements in the path of a...

Trend Micro Apex One Command Injection Vulnerability

Trend Micro Apex One is a suite of endpoint security protection software from Trend Micro that provides automated threat detection and response capabilities. A command injection vulnerability exists in Trend Micro Apex One, which can be exploited by an attacker to execute an illegal command if a...

Trend Micro OfficeScan, Apex One and Worry-Free Business Security Path Traversal Vulnerabilities

Trend Micro OfficeScan is a suite of distributed anti-virus software, Apex One is a suite of endpoint security software that provides automated threat detection and response, and Worry-Free is an enterprise-class information security solution. Business Security is a suite of enterprise-class...

CVE-2019-18188

Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution RCE. The remote process execution is bound to the IUSR...

CVE-2019-18189

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan 11.0, XG and Worry-Free Business Security 9.5, 10.0 may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication...

CVE-2019-18189

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan 11.0, XG and Worry-Free Business Security 9.5, 10.0 may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication...

Directory traversal

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan 11.0, XG and Worry-Free Business Security 9.5, 10.0 may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication...

Command injection

Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution RCE. The remote process execution is bound to the IUSR...

Directory traversal

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

CVE-2019-18188

Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution RCE. The remote process execution is bound to the IUSR...

CVE-2019-18187

CVE-2019-18187 affects Trend Micro OfficeScan versions 11.0 and XG (12.0). The issue is a directory traversal in ZIP handling that allows extracting files to a specific OfficeScan server folder, potentially enabling remote code execution. Exploitation requires an authenticated context (web servic...

CVE-2019-18188

CVE-2019-18188 affects Trend Micro Apex One (on‑premise). A command-injection vulnerability allows an attacker to extract files from an arbitrary zip into a server folder, potentially enabling remote code execution. The remote process runs under the IUSR account, which has restricted permissions....

CVE-2019-18189

CVE-2019-18189 is a directory-traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) that can bypass authentication and allow an attacker to log on to the product management console as root without authentication. Affected products and ...