CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-28575 – Trend Micro ServerProtect ioctlMod Heap-based Buffer Overflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-28575
A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target in order to exploit this vulnerability. Una vulnerabilidad de escalada de privilegios de desbordamiento de búfer en la región heap de la memoria en Trend Micro ServerProtect para Linux versión 3.0, puede permitir a un atacante escalar privilegios en las instalaciones afectadas. Un atacante primero debe obtener la capacidad de ejecutar código muy privilegiado en el objetivo a fin de explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro ServerProtect. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the ioctlMod function. • https://success.trendmicro.com/solution/000281950 https://www.zerodayinitiative.com/advisories/ZDI-20-1378 • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-28573 – Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-28573
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal the total agents managed by the server. Una vulnerabilidad de divulgación de información de control de acceso inapropiado en Trend Micro Apex One y OfficeScan XG SP1, podría permitir a un usuario no autenticado conectarse al servidor del producto y revelar el total de agentes administrados por el servidor This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application. • https://success.trendmicro.com/solution/000281947 https://success.trendmicro.com/solution/000281949 https://www.zerodayinitiative.com/advisories/ZDI-20-1374 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-28576 – Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-28576
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version and build information. Una vulnerabilidad de divulgación de información de control de acceso inapropiado en Trend Micro Apex One y OfficeScan XG SP1, podría permitir a un usuario no autenticado conectarse al servidor del producto y revelar información de versión y compilación This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application. • https://success.trendmicro.com/solution/000281947 https://success.trendmicro.com/solution/000281949 https://www.zerodayinitiative.com/advisories/ZDI-20-1375 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-28577 – Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-28577
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names. Una vulnerabilidad de divulgación de información de control de acceso inapropiado en Trend Micro Apex One y OfficeScan XG SP1, podría permitir a un usuario no autenticado conectarse al servidor del producto y revelar el nombre de host del servidor y los nombres de la base de datos This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application. • https://success.trendmicro.com/solution/000281947 https://success.trendmicro.com/solution/000281949 https://www.zerodayinitiative.com/advisories/ZDI-20-1376 •
CVSS: 9.0EPSS: 3%CPEs: 1EXPL: 1CVE-2020-28581
https://notcve.org/view.php?id=CVE-2020-28581
A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. Una vulnerabilidad de inyección de comandos en ModifyVLANItem de Trend Micro InterScan Web Security Virtual Appliance versión 6.5 SP2, podría permitir a un atacante remoto autenticado enviar mensajes HTTP especialmente diseñados y ejecutar comandos de SO arbitrarios con privilegios elevados • https://success.trendmicro.com/solution/000281954 https://www.tenable.com/security/research/tra-2020-63 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •