CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25240 – Trend Micro OfficeScan Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-25240
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain x64 agent hofitx information. Una vulnerabilidad de control de acceso inapropiado en Trend Micro Apex One (on premises y SaaS), OfficeScan XG SP1 y Worry-Free Business Security versión 10.0 SP1, podría permitir a un usuario no autenticado obtener información de las revisiones de agentes x86 This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro OfficeScan. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application. • https://success.trendmicro.com/solution/000284202 https://success.trendmicro.com/solution/000284205 https://success.trendmicro.com/solution/000284206 https://www.zerodayinitiative.com/advisories/ZDI-21-113 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-25229 – Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-25229
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the database server. Una vulnerabilidad de control de acceso inapropiado en Trend Micro Apex One (on premises y SaaS) y OfficeScan XG SP1, podría permitir a un usuario no autenticado obtener información sobre el servidor de base de datos This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application. • https://success.trendmicro.com/solution/000284202 https://success.trendmicro.com/solution/000284205 https://www.zerodayinitiative.com/advisories/ZDI-21-104 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-25235 – Trend Micro OfficeScan Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-25235
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about a content inspection configuration file. Una vulnerabilidad de control de acceso inapropiado en Trend Micro Apex One (on premises y SaaS) y OfficeScan XG SP1, podría permitir a un usuario no autenticado obtener información sobre un archivo de configuración de inspección de contenido This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro OfficeScan. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application. • https://success.trendmicro.com/solution/000284202 https://success.trendmicro.com/solution/000284205 https://www.zerodayinitiative.com/advisories/ZDI-21-110 •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25231 – Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-25231
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific hotfix history file. Una vulnerabilidad de control de acceso inapropiado en Trend Micro Apex One (on premises y SaaS), OfficeScan XG SP1 y Worry-Free Business Security versión 10.0 SP1, podría permitir a un usuario no autenticado obtener información sobre un archivo del histórico de revisiones específico This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application. • https://success.trendmicro.com/solution/000284202 https://success.trendmicro.com/solution/000284205 https://success.trendmicro.com/solution/000284206 https://www.zerodayinitiative.com/advisories/ZDI-21-106 •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25227 – Trend Micro Antivirus for Mac Memory Exhaustion Denial-Of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-25227
Trend Micro Antivirus for Mac 2021 (Consumer) is vulnerable to a memory exhaustion vulnerability that could lead to disabling all the scanning functionality within the application. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability - i.e. the attacker must already have access to the target system (either legitimately or via another exploit). Trend Micro Antivirus para Mac 2021 (Consumer) es susceptible a una vulnerabilidad de agotamiento de la memoria que podría conllevar a deshabilitar todas las funciones de escaneo dentro de la aplicación. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código poco privilegiado en el sistema objetivo a los fines de explotar esta vulnerabilidad, es decir, el atacante ya debe tener acceso al sistema objetivo (ya sea legítimamente o mediante otro explotación) This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Trend Micro Antivirus for Mac. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the iCoreService executable. • https://helpcenter.trendmicro.com/en-us/article/TMKA-10191 https://www.zerodayinitiative.com/advisories/ZDI-21-102 • CWE-400: Uncontrolled Resource Consumption •