CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11390 – Trend Micro Control Manager BasePageSessionExpire External Entity Processing Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-11390
XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706. Existe una vulnerabilidad de procesamiento de entidades XML externas (XXE) en Trend Micro Control Manager 6.0 que, de ser explotado, podría provocar que se fugue información. Anteriormente esta vulnerabilidad tenía el código ZDI-CAN-4706. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. • http://www.securityfocus.com/bid/100078 http://www.zerodayinitiative.com/advisories/ZDI-17-501 https://success.trendmicro.com/solution/1117722 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-11388 – Trend Micro Control Manager RestfulServiceUtility.NET SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-11388
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638. Una vulnerabilidad de inyección SQL en Trend Micro Control Manager 6.0 permite que se ejecute código remoto cuando RestfulServiceUtility.NET.dll no valida correctamente los strings proporcionados por el usuario antes de construir las consultas SQL. Anteriormente esta vulnerabilidad tenía los códigos ZDI-CAN-4639 y ZDI-CAN-4638. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. • http://www.securityfocus.com/bid/100078 http://www.securitytracker.com/id/1039049 http://www.zerodayinitiative.com/advisories/ZDI-17-498 http://www.zerodayinitiative.com/advisories/ZDI-17-499 https://success.trendmicro.com/solution/1117722 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •