CVE-2018-15367

A ctlset KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac Consumer 7.0 2017 and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged co...

CVE-2018-15366

CVE-2018-15366 concerns Trend Micro Antivirus for Mac (Consumer) 7.0 and later, where a flaw in the UrlfWTPPagePtr KERedirect object leads to a Use-After-Free condition. The ZDI advisory specifies the flaw exists in the KERedirect kext and stems from not validating the existence of an object befo...

CVE-2018-18327

CVE-2018-18327 affects Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and later. The vulnerability is a KERedirect untrusted pointer dereference in the KERedirect kernel extension (kext) that allows a local attacker to escalate privileges by dereferencing a user-supplied value without proper...

CVE-2018-18329

A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac Consumer 7.0 2017 and above could allow a local attacker to escalate privileges on vulnerable installations. The issue results from the lack of proper validation function on 0x6F4E offse...

CVE-2018-18328

A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac Consumer 7.0 2017 and above could allow a local attacker to escalate privileges on vulnerable installations. The issue results from the lack of proper validation function on 0x6F6A offse...

CVE-2018-15367

CVE-2018-15367 is tied to a kernel‑level privilege escalation in Trend Micro Antivirus for Mac (Consumer) v7.0+ via the ctl_set KERedirect vulnerability. The ZDI advisory states the flaw occurs in the ctl_set KERedirect kext and stems from lack of validation of a user‑supplied value before it is ...

CVE-2018-18328

CVE-2018-18328 affects Trend Micro Antivirus for Mac (Consumer) versions 7.0 (2017) and newer. The root cause is a KERedirect untrusted pointer dereference due to a lack of proper validation of a user‑supplied buffer at offset 0x6F6A, leading to a privilege escalation. An attacker must first gain...

CVE-2018-18329

CVE-2018-18329 affects Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and later. The flaw is a KERedirect untrusted pointer dereference in the KERedirect kext caused by lack of proper validation of a user-supplied buffer at offset 0x6F4E, enabling a local attacker who can run code to escalat...

This Week in Security News: Apex One™ Release and Java Usage Tracker Flaws

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Apex One enters as the evolution of Trend Micro’s endpoint security solution for enterprise. Also, learn about Java Usage Tracker’s new...

Trend Micro Anti-Virus KERedirect Untrusted Pointer Dereference Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Anti-Virus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Trend Micro Anti-Virus KERedirect Untrusted Pointer Dereference Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Anti-Virus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Trend Micro Anti-Virus KERedirect Untrusted Pointer Dereference Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Anti-Virus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Trend Micro Anti-Virus ctl_set KERedirect Untrusted Pointer Dereference Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Anti-Virus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the functio...

Trend Micro Anti-Virus UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Anti-Virus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

foreman: Stored XSS in fact name or value

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

Microsoft Zero-Day Patch for JET Bug Incomplete, Claims Firm

UPDATE Microsoft patched a zero-day in its JET Database Engine this week – but the patch was incomplete, according to researchers at 0patch. The company has developed a micropatch that corrects that hole, it said Friday. The memory corruption vulnerability CVE-2018-8423 could allow remote...

Microsoft SQL Server Management Studio 17.9 / 18.0 Preview 4 XML Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XEL-FILETYPE-XML-INJECTION-CVE-2018-8527.txt + ISR: ApparitionSec + Zero Day Initiative Program Vendor www.microsoft.com Product SQL Server...

Trend Micro Deep Discovery Inspector Cross-Site Scripting Vulnerability (CNVD-2018-20680)

Trend Micro Deep Discovery Inspector DDI is a protection product from Trend Micro that can detect and identify hard-to-find threats in real time and propose solutions. A cross-site scripting vulnerability exists in Trend Micro DDI version 3.85 and earlier versions, which can be exploited by a...

CVE-2018-15365

A Reflected Cross-Site Scripting XSS vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability...

CVE-2018-15365

A Reflected Cross-Site Scripting XSS vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability...