Code injection

A potential Man-in-the-Middle MitM attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary code on vulnerable installations...

Memory corruption

An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated users who can access the OfficeScan server to target cgiShowClientAdm.exe and cause memory corruption issues...

CVE-2017-14083: Undefined Security Weakness

A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encryption file...

CVE-2017-14087: Improper Input Validation

A Host Header Injection vulnerability in Trend Micro OfficeScan XG 12.0 may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...

CVE-2017-14086: Uncontrolled Resource Consumption

Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to start the fcgiOfcDDA.exe executable or cause a potential INI corruption, which may cause the server disk space to be consumed with...

CVE-2017-14088: Improper Restriction of Operations within the Bounds of a Memory Buffer

Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary code and escalate privileges to resources normally reserved for the kernel on vulnerable installations by exploiting tmwfp.sys. An attacker must first obtain th...

CVE-2017-14085: Exposure of Sensitive Information to an Unauthorized Actor

Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the network's NT domain or the PHP version and modules...

CVE-2017-14084: Undefined Security Weakness

A potential Man-in-the-Middle MitM attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary code on vulnerable installations...

CVE-2017-14089: Improper Restriction of Operations within the Bounds of a Memory Buffer

An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated users who can access the OfficeScan server to target cgiShowClientAdm.exe and cause memory corruption issues...

CVE-2017-14086

CVE-2017-14086 describes a pre-auth vulnerability in Trend Micro OfficeScan 11.0 and XG (12.0) where unauthenticated actors who can reach the OfficeScan server may trigger the fcgiOfcDDA.exe process or induce INI corruption, potentially causing disk space exhaustion from dump files due to continu...

CVE-2017-14083

A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encryption file...

CVE-2017-14084

A potential Man-in-the-Middle MitM attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary code on vulnerable installations...

CVE-2017-14083

CVE-2017-14083 is a vulnerability in Trend Micro OfficeScan 11.0 and XG (12.0) described as an encryption key disclosure. The core issue allows remote unauthenticated users who can access the system to download the OfficeScan encryption file (encryption key). Connected documents corroborate this ...

CVE-2017-14089

CVE-2017-14089 affects Trend Micro OfficeScan 11.0 and XG (12.0). The vulnerability is described as an unauthorized remote memory corruption in the CGI component cgiShowClientAdm.exe, exploitable by an unauthenticated attacker over the network to cause memory corruption (potential denial of servi...

CVE-2017-14086

Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to start the fcgiOfcDDA.exe executable or cause a potential INI corruption, which may cause the server disk space to be consumed with...

CVE-2017-14088

Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary code and escalate privileges to resources normally reserved for the kernel on vulnerable installations by exploiting tmwfp.sys. An attacker must first obtain th...

CVE-2017-14085

Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the network's NT domain or the PHP version and modules...

CVE-2017-14085

CVE-2017-14085 affects Trend Micro OfficeScan 11.0 and XG (12.0) where unauthenticated remote access can query the network NT domain or PHP version/modules via a web-facing OfficeScan server. The CVE is documented as an information-disclosure vulnerability with unauthorized access to server-side ...

CVE-2017-14087

CVE-2017-14087 is a Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) and OfficeScan 11.x. Public materials in the provided documents indicate affected versions include OfficeScan 11.x pre-CP 6426 SP1 and 12.x pre-CP 1708. The issue allows an attacker to spoof the Host heade...

CVE-2017-14084

Trend Micro OfficeScan 11.0 and XG/12.0 are affected by a Man-in-the-Middle (MITM) remote code execution vulnerability. Public NASL/Nessus entries describe a remote memory corruption/RCE condition tied to OfficeScan components (e.g., cgiShowClientAdm.exe) caused by improper input handling, enabli...