CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-24562 – Trend Micro OfficeScan Hard Link Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-24562
25 Sep 2020 — A vulnerability in Trend Micro OfficeScan XG SP1 on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This CVE is similar, but not identical to CVE-2020-24556. Una vulnerabilidad en Trend Micro OfficeScan XG SP1 en Microsoft Windows, puede permitir a un at... • https://success.trendmicro.com/solution/000263633 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24559 – Trend Micro Apex One Hard Link Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-24559
31 Aug 2020 — A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipulate a certain binary to load and run a script from a user-writable folder, which then would allow them to execute arbitrary code as root. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad en Trend Micro Apex One, Worry-Free Business Security 10.0 ... • https://success.trendmicro.com/solution/000263632 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.2EPSS: 0%CPEs: 25EXPL: 0CVE-2020-8607
https://notcve.org/view.php?id=CVE-2020-8607
05 Aug 2020 — An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.... • https://jvn.jp/en/vu/JVNVU99160193/index.html • CWE-20: Improper Input Validation •
CVSS: 9.4EPSS: 1%CPEs: 7EXPL: 0CVE-2020-8470
https://notcve.org/view.php?id=CVE-2020-8470
18 Mar 2020 — Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete any file on the server with SYSTEM level privileges. Authentication is not required to exploit this vulnerability. El servidor de Trend Micro Apex One (2019), OfficeScan XG y Worry-Free Business Security versiones (9.0, 9.5, 10.0), contienen un archivo DLL de servicio vulnerable que podría permitir a un atacante eliminar cualquier a... • https://success.trendmicro.com/jp/solution/000244253 •
CVSS: 10.0EPSS: 12%CPEs: 7EXPL: 0CVE-2020-8598
https://notcve.org/view.php?id=CVE-2020-8598
18 Mar 2020 — Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow a remote attacker to execute arbitrary code on affected installations with SYSTEM level privileges. Authentication is not required to exploit this vulnerability. El servidor de Trend Micro Apex One (2019), OfficeScan XG y Worry-Free Business Security versiones (9.0, 9.5, 10.0), contienen un archivo DLL de servicio vulnerable que podría permitir a un atac... • https://success.trendmicro.com/jp/solution/000244253 • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 71%CPEs: 3EXPL: 0CVE-2020-8599 – Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-8599
18 Mar 2020 — Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability. El servidor de Trend Micro Apex One (2019) y OfficeScan XG, contienen un archivo EXE vulnerable que podría permitir a un atacante remoto escribir datos arbitrarios en una ruta arbitraria en las instalaciones afectadas y omitir el inicio d... • https://success.trendmicro.com/jp/solution/000244253 •
CVSS: 10.0EPSS: 11%CPEs: 3EXPL: 0CVE-2020-8467 – Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-8467
18 Mar 2020 — A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication. Un componente de la herramienta de migración de Trend Micro Apex One (2019) y OfficeScan XG, contiene una vulnerabilidad que podría permitir a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas (RCE). Un intento de ataque requiere autenticaci... • https://success.trendmicro.com/jp/solution/000244253 •
CVSS: 8.8EPSS: 6%CPEs: 7EXPL: 0CVE-2020-8468 – Trend Micro Multiple Products Content Validation Escape Vulnerability
https://notcve.org/view.php?id=CVE-2020-8468
18 Mar 2020 — Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication. Los agentes de Trend Micro Apex One (2019), OfficeScan XG y Worry-Free Business Security versiones (9.0, 9.5, 10.0), están afectados por una vulnerabilidad de escape de comprobación de contenido que podría permitir a un atacant... • https://success.trendmicro.com/jp/solution/000244253 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.0EPSS: 0%CPEs: 12EXPL: 0CVE-2019-14688
https://notcve.org/view.php?id=CVE-2019-14688
20 Feb 2020 — Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run. Trend Micro ha reempaquetado instaladores para varios... • https://success.trendmicro.com/solution/1123562 • CWE-427: Uncontrolled Search Path Element •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19691
https://notcve.org/view.php?id=CVE-2019-19691
20 Dec 2019 — A vulnerability in Trend Micro Apex One and OfficeScan XG could allow an attacker to expose a masked credential key by manipulating page elements using development tools. Note that the attacker must already have admin/root privileges on the product console to exploit this vulnerability. Una vulnerabilidad en Trend Micro Apex One y OfficeScan XG, podría permitir a un atacante exponer una clave de credencial enmascarada mediante la manipulación de elementos de la página utilizando herramientas de desarrollo. ... • https://success.trendmicro.com/solution/000159568 •