CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8603 – Trend Micro InterScan Web Security Virtual Appliance Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2020-8603
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Una vulnerabilidad de tipo cross-site scripting (XSS) en Trend Micro InterScan Web Security Virtual Appliance versión 6.5, puede permitir a un atacante remoto alterar la interfaz web de las instalaciones afectadas. Es requerida una interacción del usuario para explotar esta vulnerabilidad, en el que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. This vulnerability allows remote attackers to tamper with the web interface of affected installations of Trend Micro InterScan Web Security Virtual Appliance. • https://success.trendmicro.com/solution/000253095 https://www.zerodayinitiative.com/advisories/ZDI-20-675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 97%CPEs: 1EXPL: 2CVE-2020-8604 – Trend Micro InterScan Web Security Virtual Appliance Apache Solr Directory Traversal Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-8604
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations. Una vulnerabilidad en Trend Micro InterScan Web Security Virtual Appliance versión 6.5, puede permitir a atacantes remotos revelar información confidencial sobre las instalaciones afectadas. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apache Solr application. When parsing the file parameter, the process does not properly validate a user-supplied path prior to using it in file operations. • http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html https://success.trendmicro.com/solution/000253095 https://www.zerodayinitiative.com/advisories/ZDI-20-678 - • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9490
https://notcve.org/view.php?id=CVE-2019-9490
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 could allow an non-authorized user to disclose administrative credentials. An attacker must be an authenticated user in order to exploit the vulnerability. Una vulnerabilidad en Trend Micro InterScan Web Security Virtual Appliance, en su versión 6.5 SP2, podría permitir a un usuario no autorizado divulgar credenciales administrativas. Un atacante debe ser un usuario autenticado para explotar esta vulnerabilidad. • http://www.securityfocus.com/bid/107848 https://success.trendmicro.com/solution/1122326 •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11396
https://notcve.org/view.php?id=CVE-2017-11396
Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potential attackers who already have administration rights to the console to implement remote code injections. Los problemas de vulnerabilidades con la inspección del servicio web de parámetros de entrada en la versión 6.5 de Trend Micro Web Security Virtual Appliance podría permitir que los atacantes que ya posean derechos de administración en la consola implementen inyecciones remotas de código. • https://success.trendmicro.com/solution/1117412 •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2017-6340 – Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2017-6340
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that allows any authenticated, remote user (even with low privileges like 'Auditor') to create or modify reports, and consequently take advantage of this XSS vulnerability. The JavaScript is executed when victims visit reports or auditlog pages. Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 en versiones anteriores a CP 1746 no sanea un nombre de archivo rest/commonlog/report/template, que permite que un usuario de 'Reports Only' inyecte JavaScript malintencionado mientras crea un nuevo informe. Además, IWSVA implementa un control de acceso incorrecto que permite a cualquier usuario remoto autenticado (incluso con privilegios bajos como "Auditor") crear o modificar informes y, en consecuencia, aprovechar esta vulnerabilidad XSS. • https://www.exploit-db.com/exploits/42013 http://www.securityfocus.com/bid/97487 https://success.trendmicro.com/solution/1116960 https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •