CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27015 – Trend Micro Antivirus for Mac Error Message Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-27015
Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. Trend Micro Antivirus for Mac 2020 (Consumer) contiene una vulnerabilidad de divulgación de información de mensajes de error que, si se explota, podría permitir que los punteros del núcleo y los mensajes de depuración se filtraran al terreno de los usuarios. Un atacante debe obtener primero la capacidad de ejecutar código de alto privilegio en el sistema objetivo para poder explotar esta vulnerabilidad This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the KERedirect kext. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09975 https://www.zerodayinitiative.com/advisories/ZDI-20-1286 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27014 – Trend Micro Antivirus for Mac Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-27014
Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash.\n\n\r\nAn attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. Trend Micro Antivirus for Mac 2020 (Consumer) contiene una vulnerabilidad de condición de carrera en el componente Web Threat Protection Blocklist, que si se explota, podría permitir a un atacante provocar el pánico o el colapso del núcleo. \n\n\r\n. Un atacante debe obtener primero la capacidad de ejecutar código de alto privilegio en el sistema objetivo para explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Antivirus for Mac. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09974 https://www.zerodayinitiative.com/advisories/ZDI-20-1285 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25777 – Trend Micro Antivirus for Mac Protection Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-25777
Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a specific kernel extension request attack where an attacker could bypass the Web Threat Protection feature of the product. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Trend Micro Antivirus para Mac versión 2020 (Consumer), es vulnerable a un ataque de petición de extensión de kernel específico donde un atacante podría omitir la funcionalidad Web Threat Protection del producto. Es requerida una interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso This vulnerability allows remote attackers to bypass web filtering on affected installations of Trend Micro Antivirus for Mac. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the KERedirect module. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09947 https://www.zerodayinitiative.com/advisories/ZDI-20-1242 •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27013 – Trend Micro Antivirus for Mac Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-27013
Trend Micro Antivirus for Mac 2020 (Consumer) contains a vulnerability in the product that occurs when a webserver is started that implements an API with several properties that can be read and written to allowing the attacker to gather and modify sensitive product and user data. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Trend Micro Antivirus para Mac versión 2020 (Consumer), contiene una vulnerabilidad en el producto que ocurre cuando un servidor web es iniciado que implementa una API con varias propiedades que pueden ser leídas y escritas al permitir a un atacante recopilar y modificar datos confidenciales del usuario y del producto. Un atacante debe primero obtener la capacidad de ejecutar código poco privilegiado en el sistema objetivo a fin de explotar esta vulnerabilidad This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the iCoreService endpoint, which listens on local TCP port 37848 by default. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09950 https://www.zerodayinitiative.com/advisories/ZDI-20-1243 •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25778 – Trend Micro Antivirus for Mac Error Message Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-25778
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. Trend Micro Antivirus para Mac versión 2020 (Consumer), presenta una vulnerabilidad en una extensión del kernel específica donde un atacante podría proporcionar un puntero del kernel y filtrar varios bytes de memoria. Un atacante debe primero obtener la capacidad de ejecutar código muy privilegiado en el sistema objetivo a fin de explotar esta vulnerabilidad This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the KERedirect kext. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09948 https://www.zerodayinitiative.com/advisories/ZDI-20-1241 • CWE-209: Generation of Error Message Containing Sensitive Information •