CVE-2019-18187

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

PT-2019-15261

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One affected versions not specified Description The issue allows an attacker to exploit a command injection vulnerability, potentially leading to the extraction of files from an arbitrary zip file to a specific folder on the...

PT-2019-5805

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11.0 and XG 12.0 Description The issue is related to a directory traversal vulnerability that could be exploited by an attacker to extract files from an arbitrary zip file to a specific folder on the OfficeScan...

CVE-2019-18189: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan 11.0, XG and Worry-Free Business Security 9.5, 10.0 may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication...

CVE-2019-18188: Improper Neutralization of Special Elements used in a Command

Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution RCE. The remote process execution is bound to the IUSR...

CVE-2019-18187

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

CVE-2019-18187: Improper Limitation of a Pathname to a Restricted Directory

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

PT-2019-15262

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One versions prior to the fixed version Trend Micro OfficeScan versions 11.0 and XG Trend Micro Worry-Free Business Security versions 9.5 and 10.0 Description A directory traversal issue may allow an attacker to bypass...

Trend Micro OfficeScan CVE-2019-18187 Directory Traversal Vulnerability

Description Trend Micro OfficeScan is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue using directory-traversal characters '../' to access or read arbitrary files that contain sensitive information or t...

Multiple Trend Micro Products CVE-2019-18189 Unspecified Directory Traversal Vulnerability

Description Multiple Trend Micro products are prone to an unspecified directory-traversal vulnerability. Remote attackers can use specially crafted requests with directory-traversal sequences '../' to access arbitrary files that contain sensitive information. This may aid in further attacks. The...

Trend Micro Apex One CVE-2019-18188 Command Injection Vulnerability

Description Trend Micro Apex One is prone to a command-injection vulnerability because it fails to properly sanitize user-supplied input. Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will...

This Week in Security News: Trend Micro Acquires Cloud Conformity and Apple Removes Malicious iOS Apps from App Store

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Trend Micro’s recent acquisition of Cloud Conformity. Also, read about a fake photo editing app on Google Play and the 17...

8x8: Reflected XSS on http://axa.dxi.eu

An older version of our ContactNow application did not adequately encode user input on one of the micro service endpoints utilized by registration...

CVE-2019-11674

Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack...

Design/Logic Flaw

Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack...

CVE-2019-11674

CVE-2019-11674 affects Micro Focus Self Service Password Reset prior to version 4.4.0.4. The issue is a certificate validation flaw enabling potential man-in-the-middle attacks. The description across connected records confirms the root cause as invalid certificate validation and implies exploita...

CVE-2019-11674

Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack...

CVE-2019-11674: Improper Certificate Validation

Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack...

Trend Micro Anti-Threat Toolkit CVE-2019-9491 Remote Code Execution Vulnerability

Description Trend Micro Anti-Threat Toolkit is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial of service condition. The following products are...

PT-2019-12472

Name of the Vulnerable Software and Affected Versions Micro Focus Self Service Password Reset versions prior to 4.4.0.4 Description The issue concerns a man-in-the-middle vulnerability that exploits invalid certificate validation, potentially resulting in a man-in-the-middle attack. Recommendatio...