CVE-2018-3600

The CVE-2018-3600 issue affects Trend Micro Control Manager 6.0, with an XXE flaw in the AdHocQuery_Processor that allows remote disclosure of sensitive information. The root cause is improper XML External Entity handling, enabling an attacker to read contents via a crafted URI and inject it back...

CVE-2018-3604

GetXXX method SQL injection remote code execution RCE vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2018-3607

XXXTreeNode method SQL injection remote code execution RCE vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2018-3601

CVE-2018-3601 affects Trend Micro Control Manager 6.0, where a password hash usage authentication bypass allows remote attackers to bypass authentication on vulnerable installations. Multiple connected sources (NVD/CNVD/ZDI) confirm the flaw arises in how authentication challenges are handled, en...

CVE-2018-3606

XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution RCE vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2018-3605

TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution RCE vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2018-3600

A external entity processing information disclosure XXE vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations...

CVE-2018-3603

A CGGIServlet SQL injection remote code execution RCE vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2018-3602

An AdHocQueryProcessor SQL injection remote code execution RCE vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2018-3602

The CVE-2018-3602 issue affects Trend Micro Control Manager 6.0 via an AdHocQuery_Processor SQL Injection that enables remote code execution. The root cause is improper validation of a user-supplied string used to build SQL queries within the GetProductCategory method of the AdHocQuery_Processor ...

CVE-2018-3607

CVE-2018-3607 relates to Trend Micro Control Manager 6.0 with a SQL injection in the XXXTreeNode method that enables remote code execution. ZDI advisories detail specific vulnerable paths (InsertSelectedTreeNodeWithACL, sp_DeleteSelectedTreeNodesByRefKey, ClearSelectedTreeNode) and note that expl...

CVE-2018-3604

Trend Micro Control Manager 6.0 is vulnerable to multiple SQL injection vulnerabilities that allow remote code execution via various GetXXX methods (GetPassword, GetRuleList, GetProductServerType) and related functions (sp_DDI_GetInterestedIPByJobID2). The root cause across advisories is lack of ...

CVE-2018-3605

Concrete details available: Multiple SQL injection-based RCE vulnerabilities exist in Trend Micro Control Manager 6.0. Reports from ZDI describe flaws where user-supplied strings are not properly validated in the reporting servlet, enabling remote code execution. Affected methods include TopSensi...

CVE-2018-3601

A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authentication on vulnerable installations...

Trend Micro IMSVA Management Portal 9.1.0.1600 Authentication Bypass

KL-001-2018-006 : Trend Micro IMSVA Management Portal Authentication Bypass Title: Trend Micro IMSVA Management Portal Authentication Bypass Advisory ID: KL-001-2018-006 Publication Date: 2018.02.08 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2018-006.txt 1. Vulnerabili...

Trend Micro IMSVA Management Portal Authentication Bypass

Vulnerability Details Affected Vendor: Trend Micro Affected Product: InterScan Mail Security Virtual Apppliance Affected Version: 9.1.0.1600 Platform: Embedded Linux CWE Classification: CWE-522: Insufficiently Protected Credentials, CWE-219: Sensitive Data Under Web Root Impact: Authentication...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 29, 2018

Late last year, Trend Micro introduced its Security Predictions for 2018. One of the predictions stated that digital extortion will be at the core of most cybercriminals’ business model. It’s much more than just ransomware – it is the most successful criminal business model in the current threat...

A Top Employer in Canada for the Second Year in a Row

Trend Micro has been protecting governments, businesses and consumers from cyber-threats for more than 28 years. Right from the start, our founders were keen to emphasize the important role played by corporations in society as a whole. To that end, we’ve always been an active participant in...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - 'dlp_policy_upload.cgi' Remote Code Execution

Summary: The vulnerabity is that the dlppolicyupload.cgi allows the upload of a zip file, located statically as: /var/dlppolicy.zip. The problem is that we can then get that file extracted using admindlp.cgi. This gets extracted into 2 locations: - /engptnstores/prod/sensorSDK/data/ -...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - dlp_policy_upload.cgi Remote Code Execution

Trend Micro Threat Discovery Appliance 2.6.1062r1 - dlppolicyupload.cgi Remote Code Execution !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get...