BEC is Big Business for Hackers: What makes these attacks so hard to prevent?

For years, one of the most lucrative ways for hackers to generate profits was through ransomware attacks. These instances involve the use of strong encryption to lock victims out of their files and data - attackers then sell the decryption key in exchange for an untraceable Bitcoin ransom payment...

This Week in Security News: Air Canada and Cryptojacking

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Air Canada reported a data breach that exposed passport details for more than 20,000 customers on their mobile app. Also, Trend Micro’s...

Trend Micro OfficeScan Information Disclosure Vulnerability (CNVD-2019-06185)

Trend Micro OfficeScan provides protection against modern threats through anti-malware, ransomware protection, memory inspection, device control and and command and control C&C traffic. A "Named Pipeline Request Handling" out-of-bounds read disclosure vulnerability exists in Trend Micro OfficeSca...

CVE-2018-15364

A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG 12.0 could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the...

CVE-2018-10514

A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2018-15363

An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

CVE-2018-10514

A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2018-10513

A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in...

CVE-2018-15363

An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

Information disclosure

A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG 12.0 could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the...

Deserialization of untrusted data

A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in...

Privilege escalation

An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

Privilege escalation

A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2018-10513

A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in...

CVE-2018-15364

The CVE-2018-15364 entry concerns Trend Micro OfficeScan XG 12.0. It describes a local, information-disclosure vulnerability in the Named Pipe Request Processing path. The root cause is a lack of input validation when processing data from a named pipe, specifically within the Ntrtscan.exe pathway...

CVE-2018-10513

The connected ZDI advisory ZDI-18-961 details a local privilege‑escalation vulnerability in Trend Micro products (e.g., Trend Micro Maximum Security) involving deserialization of untrusted data in ID_AMSP_MASTER requests. The flaw occurs in the coreServiceShell.exe service process when parsing re...

CVE-2018-10514

A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2018-15363

An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

CVE-2018-15363

An advisory for CVE-2018-15363 describes an Out-of-Bounds Read Privilege Escalation in Trend Micro Security 2018 (Consumer) products. The vulnerability stems from lack of proper validation of user-supplied data in coreServiceShell.exe (ID_AMSP_MASTER path) processing of request ID 0x2002, allowin...

CVE-2018-15364

A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG 12.0 could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the...