Information disclosure

An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 and Services could allow an attacker to disclose sensitive information about a named pipe. Please note: an attacker must first obtain t...

CVE-2021-25227

Trend Micro Antivirus for Mac 2021 Consumer is vulnerable to a memory exhaustion vulnerability that could lead to disabling all the scanning functionality within the application. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to...

Improper access control

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the contents of a scan connection exception file...

Information disclosure

An improper access control information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about an agent's managing port...

Improper access control

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain patch level information...

CVE-2021-25249

CVE-2021-25249 involves an out-of-bounds write information disclosure in Trend Micro Apex One (on‑prem and SaaS), OfficeScan XG SP1, and Worry‑Free Business Security (10.0 SP1/Services). The connected ZDI advisory details a local privilege escalation flaw in the TmCCSF.exe component, caused by la...

CVE-2021-25249

An out-of-bounds write information disclosure vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 and Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain...

CVE-2021-25248

An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 and Services could allow an attacker to disclose sensitive information about a named pipe. Please note: an attacker must first obtain t...

CVE-2021-25248

CVE-2021-25248 affects Trend Micro Apex One (on‑prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1/Services). The root cause is an out‑of‑bounds read due to insufficient validation in the vulnerable component (TmCCSF.exe per ZDI-21-118), allowing a local attacker with c...

CVE-2021-25246

An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration...

CVE-2021-25246

CVE-2021-25246 concerns Trend Micro Apex One (including Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security) where an improper access control information disclosure allows an unauthenticated attacker to create a bogus agent on an affected server to perform valid configurati...

CVE-2021-25243

The CVE-2021-25243 entry describes an improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 that could allow an unauthenticated attacker to obtain patch level information. Connected documents confirm concrete...

CVE-2021-25243

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain patch level information...

CVE-2021-25241

A server-side request forgery SSRF information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep...

CVE-2021-25242

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain version and build information...

CVE-2021-25242

CVE-2021-25242 affects Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1. Public sources in the provided documents describe an improper access control vulnerability that allows an unauthenticated user to obtain version and build information. ZDI...

CVE-2021-25241

Trend Micro CVE-2021-25241 is an SSRF information-disclosure vulnerability affecting Apex One and Worry-Free Business Security 10.0 SP1. Unauthenticated attackers could locate online agents by sweeping the affected web console. The ZDI advisory notes the flaw stems from improper access control in...

CVE-2021-25240

The CVE-2021-25240 entry concerns Trend Micro OfficeScan Apex One family products (Apex One on-prem and SaaS, OfficeScan XG SP1, Worry-Free Business Security 10.0 SP1) with an improper access control flaw. The connected advisories confirm that an unauthenticated attacker can disclose x64 agent ho...

CVE-2021-25240

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain x64 agent hofitx information...

CVE-2021-25239

CVE-2021-25239 affects Trend Micro Apex One (on-prem), OfficeScan XG SP1, and Worry‑Free Business Security 10.0 SP1. The issue is an improper access control that allows an unauthenticated user to obtain information about x86 agent hotfixes. The ZDI advisory notes that the vulnerability exists in ...