CVE-2017-11384

CVE-2017-11384 affects Trend Micro Control Manager 6.0. The vulnerability is an SQL injection in the cmdHandlerLicenseManager.dll that occurs when handling input for opcode 0x3b21, due to improper input validation, enabling remote code execution. The issue can be exploited remotely with no authen...

CVE-2017-11388

CVE-2017-11388 affects Trend Micro Control Manager 6.0. The vulnerability is a SQL injection in RestfulServiceUtility.NET.dll that fails to validate user-supplied strings when constructing SQL queries, enabling Remote Code Execution. The ZDI advisories describe exploitation requiring authenticati...

CVE-2017-11385

CVE-2017-11385 affects Trend Micro Control Manager 6.0. The issue is an SQL injection in cmdHandlerStatusMonitor.dll triggered by improper validation when handling opcode 0x6b1b, enabling remote code execution. Public disclosures (ZDI-17-495, NVD entry) describe unauthenticated remote exploitatio...

CVE-2017-11389

CVE-2017-11389 is a directory traversal vulnerability in Trend Micro Control Manager 6.0 that allows remote code execution by dropping arbitrary files in a web-facing directory. The root cause is improper validation of a user-supplied path in the module cmdHandlerFileHandling.dll, enabling an att...

CVE-2017-11387

Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can change debug logging level. Formerly ZDI-CAN-4512...

CVE-2017-11383

Trend Micro Control Manager (TMCM) 6.0 contains a SQL injection in cmdHandlerTVCSCommander.dll when handling opcode 0x1b07 due to insufficient validation of user input, enabling remote code execution. Public advisories (ZDI-17-493) and CVE-2017-11383 describe remote exploitation without authentic...

CVE-2017-11389

Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684...

CVE-2017-11386

Trend Micro Control Manager 6.0 is affected by a SQL injection in the component cmdHandlerNewReportScheduler.dll when processing opcode 0x4707, caused by lack of proper input validation. This vulnerability can lead to Remote Code Execution and is documented as CVE-2017-11386 (ZDI-17-496). Public ...

CVE-2017-11390

XML external entity XXE processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706...

CVE-2017-11390

This CVE concerns an XML External Entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0. The issue stems from XXE handling in the product’s input processing, enabling information disclosure if an attacker supplies malicious XML. Multiple connected sources (NVD entry, ZDI adviso...

Trend Micro Control Manager cmdHandlerTVCSCommander.dll File SQL Injection Vulnerability

Trend Micro Control Manager TMCM is an integrated threat detection and data protection management center software from Trend Micro. A SQL injection vulnerability exists in TMCM version 6.0, which stems from the cmdHandlerTVCSCommander.dll file failing to adequately validate user input. A remote...

Trend Micro OfficeScan Proxy Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro OfficeScan. Authentication is required to exploit this vulnerability. The specific flaw exists within the Web Console, which listens on TCP port 4343 by default. When parsing the T...

Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within cmdHandlerLicenseManager.dll when executing opcode 0x3b21. The issue result...

Trend Micro Control Manager cmdHandlerStatusMonitor SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within cmdHandlerStatusMonitor.dll when executing opcode 0x6b1b. The issue results...

Trend Micro Control Manager Directory Traversal Vulnerability

Trend Micro Control Manager is the centralized management console for managing Trend Micro products and services. A directory traversal vulnerability exists in Trend Micro Control Manager, which could be exploited by remote attackers to submit a specific request to execute arbitrary code or view...

Trend Micro Control Manager SQL Injection Vulnerability (CNVD-2017-20422)

Trend Micro Control Manager is the centralized management console for managing Trend Micro products and services. A SQL injection vulnerability in Trend Micro Control Manager allows remote attackers to submit specially crafted SQL queries to manipulate or obtain database data...

Trend Micro Deep Discovery Director Command Injection Vulnerability

Trend Micro Deep Discovery is a protection product from Trend Micro that detects and identifies hard-to-find threats in real time and proposes solutions. director is one of the built-in solutions with the ability to update and upgrade various programs in Deep Discovery. A command injection...

Trend Micro Deep Discovery Director Unverified Backup Vulnerability

Trend Micro Deep Discovery is a protection product from Trend Micro that detects and identifies hard-to-find threats in real time and proposes solutions. director is one of the built-in solutions with the ability to update and upgrade various programs in Deep Discovery. A security vulnerability...

Trend Micro Control Manager XML External Entity Vulnerability

Trend Micro Control Manager is the centralized management console for managing Trend Micro products and services. A security vulnerability in Trend Micro Control Manager's handling of XML external entities allows remote attackers to exploit the vulnerability by submitting specialized XML data,...

Trend Micro Deep Discovery Email Inspector Denial of Service Vulnerability

Trend Micro Deep Discovery Email Inspector is an email protection device from Trend Micro that can detect and identify undetectable threats in real time and propose solutions. A denial of service vulnerability exists in Trend Micro Deep Discovery Email Inspector version 2.5.1. A remote attacker c...