Design/Logic Flaw

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

Cross site request forgery (csrf)

The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

Directory traversal

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources - could be exploited to overwrite sensitive files in the ScanMail for Exchange directory...

CVE-2017-14090

CVE-2017-14090 affects Trend Micro ScanMail for Exchange 12.0. The vulnerability lies in the update mechanism: communications to update servers are unencrypted (HTTP) and lack certificate validation, enabling eavesdropping/tampering. Core Security’s advisory details that vulnerable update paths a...

CVE-2017-14091

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources - could be exploited to overwrite sensitive files in the ScanMail for Exchange directory...

CVE-2017-14092

CVE-2017-14092 describes a Cross-Site Request Forgery vulnerability in Trend Micro ScanMail for Exchange (SMEX) 12.x web interface. Root cause: the web forms lack Anti-CSRF tokens, allowing an authenticated user who visits a malicious domain to submit authenticated requests to the SMEX web consol...

CVE-2017-14091

Trend Micro ScanMail for Exchange 12.0/12 SP1 Patch 1 (SMEX) is affected by CVE-2017-14091 via its update mechanism. The issue arises when administrators configure alternative download sources for updates; those packages are not signed or validated (only size matched), enabling an attacker to ove...

CVE-2017-14092

The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

CVE-2017-14090

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

CVE-2017-14093

Trend Micro ScanMail for Exchange 12.x (SMEX) contains a cross-site scripting vulnerability (CVE-2017-14093) in the Web-based Logs and Quarantine Query pages. The root cause is improper input handling on the logs/ Quarantine pages, allowing injected script via parameters such as optRemoteLog, txt...

Trend Micro ScanMail for Exchange 12.x < SP1 Patch 1 CP1755

The version of Trend Micro ScanMail for Exchange SMEX installed on the remote Windows host is affected by multiple vulnerabilities, including cross-site scripting XSS and weak anti cross-site request forgery CSRF. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104354...

Trend Micro ScanMail for Exchange 10.2 < Build 3318 / 11.x < Build 4180 Predictable Session IDs

The version of Trend Micro ScanMail for Exchange SMEX installed on the remote Windows host is affected by a flaw in its bundled web-based user interface due to insufficient complexity in the generation of session IDs. A remote attacker, by more easily guessing the session ID, can use an...

Trend Micro ScanMail for Exchange Installation Detection

Binary data trendmicrosmexinstalled.nbin...

Trend Micro ScanMail for Exchange Web Console Detection

Binary data trendmicrosmexwebuidetect.nbin...

Trend Micro ScanMail for Microsoft Exchange Authentication Bypass Vulnerability

Trend Micro ScanMail for Microsoft Exchange is a virus scanning program for Exchange mail servers. Trend Micro ScanMail for Microsoft Exchange SMEX prior to 10.2 Hot Fix Build 3318 and prior to 11.0 Hot Fix Build 4180 uses a guessable random number generator to generate the session ID of the WEB...

CVE-2015-3326

Trend Micro ScanMail for Microsoft Exchange SMEX 10.2 before Hot Fix Build 3318 and 11.0 before Hot Fix Build 4180 creates session IDs for the web console using a random number generator with predictable values, which makes it easier for remote attackers to bypass authentication via a brute force...

Authentication flaw

Trend Micro ScanMail for Microsoft Exchange SMEX 10.2 before Hot Fix Build 3318 and 11.0 before Hot Fix Build 4180 creates session IDs for the web console using a random number generator with predictable values, which makes it easier for remote attackers to bypass authentication via a brute force...

CVE-2015-3326

Trend Micro ScanMail for Microsoft Exchange (SMEX) versions affected: 10.2 before Hot Fix Build 3318 and 11.0 before Hot Fix Build 4180. The vulnerability stems from generating session IDs for the web console with a predictable random number generator, enabling remote attackers to attempt brute‑f...

Trend Micro ScanMail for Domino 2.51/2.6 - Remote File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11612/info ScanMail for Domino is reported prone to a vulnerability that may allow sensitive configuration files to be disclosed to remote attackers. A successful attack may allow an attacker to disclose sensitive...

Softek MailMarshal 4,Trend Micro ScanMail 1.0 SMTP Attachment Protection Bypass

No description provided by source. source: http://www.securityfocus.com/bid/3097/info At least two SMTP gateway products have been identified which contain flaws in the handling of restricted filetypes as attachments. An attacker can insert extraneous characters in the filename extension of a...