CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28649 – Trend Micro HouseCall for Home Networks Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-28649
An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Una vulnerabilidad de permiso incorrecto en el instalador del producto para Trend Micro HouseCall for Home Networks versiones 5.3.1179 y anteriores, podría permitir a un atacante escalar privilegios colocando código arbitrario en una carpeta específica y que un administrador que esté ejecutando un escaneo ejecutar ese código. Tome en cuenta que un atacante debe primero obtener la habilidad de ejecutar código poco privilegiado en el sistema de destino para explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro HouseCall for Home Networks. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. • https://helpcenter.trendmicro.com/en-us/article/TMKA-10310 https://www.zerodayinitiative.com/advisories/ZDI-21-474 • CWE-276: Incorrect Default Permissions •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-31519 – Trend Micro HouseCall for Home Networks Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-31519
An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Una vulnerabilidad de permiso incorrecto en las carpetas del instalador del producto para Trend Micro HouseCall for Home Networks versiones 5.3.1179 y anteriores, podría permitir a un atacante escalar privilegios al colocar código arbitrario en una carpeta específica y que ese código sea ejecutado por un administrador que esté ejecutando un escaneo. Tome en cuenta que un atacante debe primero obtener la habilidad de ejecutar código poco privilegio en el sistema de destino para explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro HouseCall for Home Networks. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. • https://helpcenter.trendmicro.com/en-us/article/TMKA-10310 https://www.zerodayinitiative.com/advisories/ZDI-21-475 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28648 – Trend Micro Antivirus for Mac Improper Access Control Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-28648
Trend Micro Antivirus for Mac 2020 v10.5 and 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker to establish a connection that could lead to full local privilege escalation within the application. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Trend Micro Antivirus para Mac 2020 versiones v10.5 y 2021 v11 (Consumidor) es susceptible a una vulnerabilidad de escalada de privilegios de control de acceso inapropiado que podría permitir a un atacante establecer una conexión que podría conllevar a una escalada de privilegios local completa dentro de la aplicación. Tome en cuenta que un atacante primero debe obtener la capacidad de ejecutar código poco privilegiado en el sistema objetivo para explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within com.trendmicro.AFM.HelperTool. • https://helpcenter.trendmicro.com/en-us/article/TMKA-10293 https://www.zerodayinitiative.com/advisories/ZDI-21-420 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28647
https://notcve.org/view.php?id=CVE-2021-28647
Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file during the installation progress and could execute a malicious program each time a user installs a program. Trend Micro Password Manager versión 5 (Consumer) es vulnerable a una vulnerabilidad de secuestro DLL que podría permitir a un atacante inyectar un archivo DLL malicioso durante el progreso de la instalación y podría ejecutar un programa malicioso cada vez que un usuario instala un programa • https://helpcenter.trendmicro.com/en-us/article/TMKA-10282 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-28646
https://notcve.org/view.php?id=CVE-2021-28646
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations. Una vulnerabilidad de permisos de archivo no segura en Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1, podría permitir a un atacante local tomar el control de un archivo de registro específico en las instalaciones afectadas • https://success.trendmicro.com/solution/000286019 https://success.trendmicro.com/solution/000286157 • CWE-732: Incorrect Permission Assignment for Critical Resource •