CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-44647 – Trend Micro Apex One Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-44647
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not the same as CVE-2022-44648. Una vulnerabilidad de lectura fuera de los límites en Trend Micro Apex One y Apex One as a Service podría permitir a un atacante local revelar información confidencial sobre las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad. Esto es similar, pero no igual, a CVE-2022-44648. This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Apex One Security Agent. • https://success.trendmicro.com/solution/000291770 https://www.zerodayinitiative.com/advisories/ZDI-22-1617 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-44649 – Trend Micro Apex One Unauthorized Change Prevention Service Out-Of-Bounds Access Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-44649
An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad de acceso fuera de los límites en el servicio de Prevención de Cambios No Autorizados de Trend Micro Apex One y Apex One as a Service podría permitir a un atacante local elevar los privilegios en las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad. This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Unauthorized Change Prevention Service. • https://success.trendmicro.com/solution/000291770 https://www.zerodayinitiative.com/advisories/ZDI-22-1619 • CWE-787: Out-of-bounds Write •
CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 0CVE-2022-41748
https://notcve.org/view.php?id=CVE-2022-41748
A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials to bypass certain elements of the product's anti-tampering mechanisms on affected installations. Please note: an attacker must first obtain administrative credentials on the target system in order to exploit this vulnerability. Una vulnerabilidad de los permisos del registro en el módulo de prevención de pérdida de datos (DLP) de Trend Micro Apex One podría permitir a un atacante local con credenciales administrativas omitir determinados elementos de los mecanismos anti manipulación del producto en las instalaciones afectadas. Nota: un atacante debe obtener primero credenciales administrativas en el sistema de destino para poder explotar esta vulnerabilidad • https://success.trendmicro.com/solution/000291645 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-41744 – Trend Micro Apex One Vulnerability Protection Service Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-41744
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate privileges and turn a specific working directory into a mount point on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad del componente integrado Trend Micro Apex One Vulnerability Protection podría permitir a un atacante local escalar privilegios y convertir un directorio de trabajo específico en un punto de montaje en las instalaciones afectadas. Nota: un atacante debe obtener primero la capacidad de ejecutar código poco privilegiado en el sistema de destino para poder explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One Vulnerability Protection Service. • https://success.trendmicro.com/solution/000291645 https://www.zerodayinitiative.com/advisories/ZDI-22-1404 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-41745 – Trend Micro Apex One Security Agent Out-Of-Bounds Access Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-41745
An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause memory corruption on a certain service process which could lead to local privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad de acceso fuera de límites en Trend Micro Apex One podría permitir a un atacante local crear un mensaje especialmente diseñado para causar la corrupción de la memoria en un determinado proceso de servicio que podría conllevar a una escalada de privilegios local en las instalaciones afectadas. Nota: un atacante debe obtener primero la capacidad de ejecutar código poco privilegiado en el sistema de destino para poder explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One NT Listener service. • https://success.trendmicro.com/solution/000291645 https://www.zerodayinitiative.com/advisories/ZDI-22-1401 • CWE-125: Out-of-bounds Read •