Page 2 of 12 results (0.031 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2

CVE-2017-14096 – Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control

https://notcve.org/view.php?id=CVE-2017-14096

A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to execute a malicious payload on vulnerable systems. Una vulnerabilidad de Cross-Site Scripting (XSS) persistente en Trend Micro Smart Protection Server (Standalone) en versiones 3.2 y anteriores podría permitir que un atacante ejecute una carga útil maliciosa en sistemas vulnerables. Trend Micro Smart Protection Server version 3.2 suffers from access control bypass, cross site scripting, information disclosure, and various other vulnerabilities. • https://www.exploit-db.com/exploits/43388 http://www.securityfocus.com/bid/102275 https://success.trendmicro.com/solution/1118992 https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 2

CVE-2017-14094 – Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control

https://notcve.org/view.php?id=CVE-2017-14094

A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cron job injection on a vulnerable system. Una vulnerabilidad en Trend Micro Smart Protection Server (Standalone), en versiones 3.2 y anteriores, podría permitir que un atacante realice la ejecución remota de comandos mediante una inyección cron job en un sistema vulnerable. Trend Micro Smart Protection Server version 3.2 suffers from access control bypass, cross site scripting, information disclosure, and various other vulnerabilities. • https://www.exploit-db.com/exploits/43388 http://www.securityfocus.com/bid/102275 https://success.trendmicro.com/solution/1118992 https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 2

CVE-2017-14095 – Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control

https://notcve.org/view.php?id=CVE-2017-14095

A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system. Una vulnerabilidad en Trend Micro Smart Protection Server (Standalone), en versiones 3.2 y anteriores, podría permitir que un atacante realice la ejecución remota de comandos mediante una inclusión de archivos locales en un sistema vulnerable. Trend Micro Smart Protection Server version 3.2 suffers from access control bypass, cross site scripting, information disclosure, and various other vulnerabilities. • https://www.exploit-db.com/exploits/43388 http://www.securityfocus.com/bid/102275 https://success.trendmicro.com/solution/1118992 https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-829: Inclusion of Functionality from Untrusted Control Sphere •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2016-6268

https://notcve.org/view.php?id=CVE-2016-6268

Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory. Trend Micro Smart Protection Server 2.5 en versiones anteriores a build 2200, 2,6 en versiones anteriores a build 2106 y 3,0 en versiones anteriores a build 1330 permite a los usuarios locales de webserv ejecutar código arbitrario con privilegios de root a través de un archivo troyano .war en el directorio Solr webapps. • https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps https://success.trendmicro.com/solution/1114913 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 90%CPEs: 3EXPL: 1

CVE-2016-6267

https://notcve.org/view.php?id=CVE-2016-6267

SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php. SnmpUtils en Trend Micro Smart Protection Server 2.5 en versiones anteriores a build 2200, 2,6 en versiones anteriores a build 2106 y 3,0 en versiones anteriores a build 1330 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través de metacaracteres de shell en (1) spare_Community, (2) spare_AllowGroupIP o (3) parámetro spare_AllowGroupNetmask para admin_notification.php. • https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps https://success.trendmicro.com/solution/1114913 - • CWE-20: Improper Input Validation •