Trend Micro Deep Discovery Email Inspector Denial of Service Vulnerability

Trend Micro Deep Discovery Email Inspector is an email protection device from Trend Micro that can detect and identify undetectable threats in real time and propose solutions. A denial of service vulnerability exists in Trend Micro Deep Discovery Email Inspector version 2.5.1. A remote attacker c...

Trend Micro Control Manager cmdHandlerTVCSCommander SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within cmdHandlerTVCSCommander.dll when executing opcode 0x1b07. The issue results...

Trend Micro Control Manager cmdHandlerNewReportScheduler SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within cmdHandlerNewReportScheduler.dll when executing opcode 0x4707. The issue...

CVE-2017-11381

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console...

CVE-2017-11379

Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1...

CVE-2017-11380

Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1...

CVE-2017-11381

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console...

CVE-2017-11380

Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1...

Command injection

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console...

Design/Logic Flaw

Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1...

CVE-2017-11379

Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1...

CVE-2017-11379

CVE-2017-11379 (and related CVEs 11380, 11381) affect Trend Micro Deep Discovery Director 1.1. Core Security CORE-2017-0005 reports vulnerabilities in the backup/restore workflow: backups are not signed/validated, archives are encrypted with a static password across appliances, and a command-inje...

CVE-2017-11380

The connected CORE advisory for Trend Micro Deep Discovery Director 1.1 details CVE-2017-11380 (backup archives encrypted with a static, hard-coded password) and CVE-2017-11381 (command injection during backup-restore accounts handling), enabling potential code execution with root privileges via ...

CVE-2017-11381

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console...

CVE-2017-11380

Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1...

CVE-2017-11381

Summary: CVE-2017-11381 affects Trend Micro Deep Discovery Director 1.1. A command injection vulnerability exists in the backup/restore flow that can be exploited to restore accounts and ultimately gain code execution as root. The issue arises during the restore of textUI accounts: the process as...

Mitsubishi Electric Europe B.V. E-Designer

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Mitsubishi Electric Europe B.V. Equipment: E-Designer Vulnerabilities: Heap-Based Buffer Overflow, Stack-Based Buffer Overflow, Out-of-Bounds Write AFFECTED PRODUCTS The following version of E-Designer, a Mitsubishi...

Trend Micro Control Manager Debug Level Authentication Bypass Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of debug settings. The software does not provide...

Trend Micro Control Manager BasePageSessionExpire External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within BasePageSessionExpire.cs. Due to the improper restriction of XML...

Trend Micro Control Manager cmdHandlerFileHandling Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within cmdHandlerFileHandling.dll. The issue results from the lack of proper...