CVE-2018-10357

A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the FileDrop servlet. Authentication is required to exploit this vulnerability...

Remote code execution

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability...

Authentication flaw

A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRegistration2 class. Authentication is required to exploit this vulnerability...

Command injection

A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the LauncherServer. Authentication is required to exploit this vulnerability...

CVE-2018-10352

A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formConfiguration class. Authentication is required to exploit this vulnerability...

CVE-2018-10357

A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the FileDrop servlet. Authentication is required to exploit this vulnerability...

CVE-2018-10355

CVE-2018-10355 affects Trend Micro Email Encryption Gateway (TMEEG) version 5.5. The vulnerability resides in the DBCrypto class, which stores user passwords using a hard-coded key in a recoverable format. An attacker who gains access to the target’s user database can exploit the flaw to recover ...

CVE-2018-10357

Trend Micro Endpoint Application Control 2.0 contains a directory traversal vulnerability in the FileDrop servlet that can allow a remote attacker to execute arbitrary code. Multiple sources (including ZDI-18-469 and CNVD/NVD variants) describe that authentication is required to exploit, and the ...

CVE-2018-10351

A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRegistration2 class. Authentication is required to exploit this vulnerability...

CVE-2018-10352

A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formConfiguration class. Authentication is required to exploit this vulnerability...

CVE-2018-10353

A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability...

CVE-2018-10354

A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the LauncherServer. Authentication is required to exploit this vulnerability...

CVE-2018-10351

Trend Micro Email Encryption Gateway 5.5 contains a SQL injection in the formRegistration2 class that enables a remote attacker to execute arbitrary SQL statements. Exploitation is possible remotely with network access and requires authentication (though ZDI notes the authentication can be bypass...

CVE-2018-10354

The CVE-2018-10354 issue affects Trend Micro Email Encryption Gateway 5.5, arising from a flaw in LauncherServer that permits command injection and remote code execution. A remote attacker could run arbitrary code on vulnerable installations; authentication is required to exploit per the primary ...

CVE-2018-10353

The CVE-2018-10353 entry concerns Trend Micro Email Encryption Gateway 5.5, where a flaw in the formChangePass class enables a SQL injection information disclosure vulnerability. The vulnerability potentially allows a remote attacker to disclose sensitive information on affected installations. Au...

CVE-2018-10352

The CVE-2018-10352 entry concerns Trend Micro Email Encryption Gateway 5.5, with a vulnerability in the formConfiguration class that enables SQL injection. A remote attacker could execute arbitrary SQL statements on vulnerable installations (authentication required). Multiple connected sources co...

CVE-2018-10356

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability...

CVE-2018-10355

An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover user passwords on vulnerable installations due to a flaw in the DBCrypto class. An attacker must first obtain access to the user database on the target system in order to exploi...

CVE-2018-10356

CVE-2018-10356 affects Trend Micro Email Encryption Gateway 5.5. A SQL injection vulnerability in the formRequestDomains class can lead to remote code execution. Auth is required to exploit, but at least one connected advisory notes authentication bypass or bypass potential, enabling arbitrary SQ...

Hackers are exploiting a new zero-day flaw in GPON routers

Even after being aware of various active cyber attacks against the GPON Wi-Fi routers, if you haven't yet taken them off the Internet, then be careful—because a new botnet has joined the GPON party, which is exploiting an undisclosed zero-day vulnerability in the wild. Security researchers from...