CVE-2016-7552

CVE-2016-7552 affects Trend Micro Threat Discovery Appliance 2.6.1062r1. Affected component: logoff.cgi, where processing of the session_id cookie triggers a directory traversal vulnerability that can let a remote, unauthenticated attacker delete files as root, bypass authentication, or cause a D...

CVE-2016-7547

CVE-2016-7547 affects Trend Micro Threat Discovery Appliance (TDA) where the admin_sys_time.cgi interface accepts the timezone parameter, enabling remote command execution. Public material in connected sources confirms post-authentication/exploits and Mirroring in Metasploit: Trend Micro Threat D...

CVE-2016-8589

CVE-2016-8589 affects Trend Micro Threat Discovery Appliance

CVE-2016-8585

CVE-2016-8585 affects Trend Micro Threat Discovery Appliance,

CVE-2016-8593

Trend Micro Threat Discovery Appliance (TDA)

CVE-2016-8590

CVE-2016-8590 affects Trend Micro Threat Discovery Appliance (TDA) 2.6.1062r1 and earlier. The vulnerability in log_query_dlp.cgi allows remote authenticated users to execute arbitrary code as root via shell metacharacters in the cache_id parameter, with public PoCs/exploits noted (e.g., Seebug, ...

CVE-2016-8591

CVE-2016-8591 affects Trend Micro Threat Discovery Appliance (TDA)

CVE-2016-8584

CVE-2016-8584 affects Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier, where predictable session values enable remote attackers to bypass authentication by guessing the session value. The description states an authentication bypass via session generation, with CVSS metrics indicatin...

CVE-2016-8586

CVE-2016-8586 affects Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier. The vulnerability is in the detected_potential_files.cgi component, where shell metacharacters in the cache_id parameter allow a remote authenticated user to execute arbitrary code as root. The provided documents...

CVE-2016-8587

CVE-2016-8587 affects Trend Micro Threat Discovery Appliance prior to or including 2.6.1062r1, in the dlp_policy_upload.cgi handler. The flaw arises when an uploaded archive containing a symlink is extracted, allowing a remote authenticated attacker to place a symlink to sensitive locations (for ...

CVE-2016-8592

Affected product: Trend Micro Threat Discovery Appliance (TDA) versions 2.6.1062r1 and earlier. Component exposed: log_query_system.cgi. Vulnerability: remote authenticated users can inject shell metacharacters via the cache_id parameter to execute arbitrary code with root privileges. This is a p...

CVE-2016-8588

The CVE-2016-8588 issue affects Trend Micro Threat Discovery Appliance (TDA) version 2.6.1062r1 and earlier. The hotfix_upload.cgi CGI allows a remote authenticated user to execute arbitrary code by supplying shell metacharacters in the filename of an uploaded file, enabling remote code execution...