CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25777 – Trend Micro Antivirus for Mac Protection Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-25777
Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a specific kernel extension request attack where an attacker could bypass the Web Threat Protection feature of the product. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Trend Micro Antivirus para Mac versión 2020 (Consumer), es vulnerable a un ataque de petición de extensión de kernel específico donde un atacante podría omitir la funcionalidad Web Threat Protection del producto. Es requerida una interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso This vulnerability allows remote attackers to bypass web filtering on affected installations of Trend Micro Antivirus for Mac. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the KERedirect module. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09947 https://www.zerodayinitiative.com/advisories/ZDI-20-1242 •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27013 – Trend Micro Antivirus for Mac Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-27013
Trend Micro Antivirus for Mac 2020 (Consumer) contains a vulnerability in the product that occurs when a webserver is started that implements an API with several properties that can be read and written to allowing the attacker to gather and modify sensitive product and user data. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Trend Micro Antivirus para Mac versión 2020 (Consumer), contiene una vulnerabilidad en el producto que ocurre cuando un servidor web es iniciado que implementa una API con varias propiedades que pueden ser leídas y escritas al permitir a un atacante recopilar y modificar datos confidenciales del usuario y del producto. Un atacante debe primero obtener la capacidad de ejecutar código poco privilegiado en el sistema objetivo a fin de explotar esta vulnerabilidad This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the iCoreService endpoint, which listens on local TCP port 37848 by default. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09950 https://www.zerodayinitiative.com/advisories/ZDI-20-1243 •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25778 – Trend Micro Antivirus for Mac Error Message Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-25778
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. Trend Micro Antivirus para Mac versión 2020 (Consumer), presenta una vulnerabilidad en una extensión del kernel específica donde un atacante podría proporcionar un puntero del kernel y filtrar varios bytes de memoria. Un atacante debe primero obtener la capacidad de ejecutar código muy privilegiado en el sistema objetivo a fin de explotar esta vulnerabilidad This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the KERedirect kext. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09948 https://www.zerodayinitiative.com/advisories/ZDI-20-1241 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25779
https://notcve.org/view.php?id=CVE-2020-25779
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in which a Internationalized Domain Name homograph attack (Puny-code) could be used to add a malicious website to the approved websites list of Trend Micro Antivirus for Mac to bypass the web threat protection feature. Trend Micro Antivirus para Mac versión 2020 (Consumer), presenta una vulnerabilidad en la que un ataque de homógrafo Internationalized Domain Name (código Puny) podría ser usado para agregar un sitio web malicioso a la lista de sitios web aprobados de Trend Micro Antivirus para Mac para omitir la funcionalidad web threat protection • https://helpcenter.trendmicro.com/en-us/article/TMKA-09949 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25776 – Trend Micro Antivirus for Mac Symbolic Link Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-25776
Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a symbolic link privilege escalation attack where an attacker could exploit a critical file on the system to escalate their privileges. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Trend Micro Antivirus para Mac 2020 (Consumer) es vulnerable a un ataque de escalada de privilegios de enlace simbólico donde un atacante podría explotar un archivo crítico en el sistema para escalar sus privilegios. Un atacante debe primero obtener la capacidad de ejecutar código poco privilegiado en el sistema objetivo para explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the iTISPlugin module. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09924 https://www.zerodayinitiative.com/advisories/ZDI-20-1236 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •