CVSS: 5.5EPSS: 0%CPEs: 39EXPL: 0CVE-2021-25252
https://notcve.org/view.php?id=CVE-2021-25252
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file. La API Virus Scan (VSAPI) y el Advanced Threat Scan Engine (ATSE) de Trend Micro, son susceptibles a una vulnerabilidad de agotamiento de la memoria que puede conllevar a una denegación de servicio o a un congelamiento del sistema si es explotada por un atacante usando un archivo especialmente diseñado • https://success.trendmicro.com/solution/000285675 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15365
https://notcve.org/view.php?id=CVE-2018-15365
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability. Una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Trend Micro Deep Discovery Inspector en versiones 3.85 y anteriores podría permitir que un atacante omita la protección CSRF y lleve a cabo un ataque en instalaciones vulnerables. El atacante debe ser un usuario autenticado para explotar esta vulnerabilidad. • https://github.com/nixwizard/CVE-2018-15365 https://success.trendmicro.com/solution/1121079 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-11382 – Trend Micro Deep Discovery Email Inspector kdump_setting Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2017-11382
Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350. Una vulnerabilidad de denegación de servicio en Trend Micro Deep Discovery Email Inspector, versión 2.5.1 permite que atacantes remotos eliminen archivos arbitrarios en instalaciones vulnerables, por lo que se deshabilita el servicio. This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Trend Micro Deep Discovery Email Inspector. Authentication is not required to exploit this vulnerability. The specific flaw exists within kdump_setting.php. • http://www.securityfocus.com/bid/100076 http://www.zerodayinitiative.com/advisories/ZDI-17-503 https://success.trendmicro.com/solution/1116750 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2015-2872 – Trend Micro Deep Discovery 3.7.1096 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-2872
Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web script or HTML via (1) crafted input to index.php that is processed by certain Internet Explorer 7 configurations or (2) crafted input to the widget feature. Múltiples vulnerabilidades de XSS en Trend Micro Deep Discovery Inspector (DDI) en el aparato Deep Discovery Threat con software anterior a 3.5.1477, 3.6.x en versiones anteriores a 3.6.1217, 3.7.x en versiones anteriores a 3.7.1248, 3.8.x en versiones anteriores a 3.8.1263 y otras versiones, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) entrada manipulada a index.php que es procesada por ciertas configuraciones de Internet Explorer 7 o a través de (2) entrada manipulada al componente de widget. Trend Micro Deep Discovery version 3.7.1096 suffers from a cross site scripting vulnerability. • http://esupport.trendmicro.com/solution/en-US/1112206.aspx http://www.kb.cert.org/vuls/id/248692 http://www.securityfocus.com/bid/76397 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2015-2873 – Trend Micro Deep Discovery 3.7.1096 Authentication Bypass
https://notcve.org/view.php?id=CVE-2015-2873
Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL. Vulnerabilidad en Trend Micro Deep Discovery Inspector (DDI) en el aparato Deep Discovery Threat con software anterior a 3.5.1477, 3.6.x en versiones anteriores a 3.6.1217, 3.7.x en versiones anteriores a 3.7.1248, 3.8.x en versiones anteriores a 3.8.1263 y otras versiones, permite a atacantes remotos obtener información sensible o cambiar la configuración a través de una petición directa al (1) sistema de log URL, (2)a la lista blanca de URL o (3) a la lista negra de URL. Trend Micro Deep Discovery Threat Appliance version 3.7.1096 Certain Deep Discovery Inspector URLs including the system log and whitelist/blacklist are accessible to a non-administrator user because the pages do not properly check for authorization. An unauthenticated user without administrator privileges may thus gain access to and modify certain system configuration settings. • http://esupport.trendmicro.com/solution/en-US/1112206.aspx http://www.kb.cert.org/vuls/id/248692 http://www.securityfocus.com/bid/76396 • CWE-425: Direct Request ('Forced Browsing') •