CVSS: 9.8EPSS: 13%CPEs: 1EXPL: 0CVE-2017-11389 – Trend Micro Control Manager cmdHandlerFileHandling Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-11389
Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684. Existe una vulnerabilidad de tipo Directory Traversal en Trend Micro Control Manager 6.0 que permite que se ejecute código remoto por atacantes capaces de ubicar archivos arbitrarios en un directorio expuesto en Internet. Anteriormente esta vulnerabilidad tenía el código ZDI-CAN-4684. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. • http://www.securityfocus.com/bid/100078 http://www.securitytracker.com/id/1039049 http://www.zerodayinitiative.com/advisories/ZDI-17-500 https://success.trendmicro.com/solution/1117722 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2017-11390 – Trend Micro Control Manager BasePageSessionExpire External Entity Processing Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-11390
XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706. Existe una vulnerabilidad de procesamiento de entidades XML externas (XXE) en Trend Micro Control Manager 6.0 que, de ser explotado, podría provocar que se fugue información. Anteriormente esta vulnerabilidad tenía el código ZDI-CAN-4706. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. • http://www.securityfocus.com/bid/100078 http://www.zerodayinitiative.com/advisories/ZDI-17-501 https://success.trendmicro.com/solution/1117722 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 4%CPEs: 12EXPL: 1CVE-2012-2998 – Trend Micro Control Manager 5.5/6.0 AdHocQuery - (Authenticated) Blind SQL Injection
https://notcve.org/view.php?id=CVE-2012-2998
SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en el módulo ad hoc en Trend Micro Control Manager (TMCM) anterior a v5.5.0.1823 y v6.0 anterior a v6.0.0.1449 permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores no especificados. Trend Micro Control Manager versions 5.5 and 6.0 suffer from an AdHocQuery remote blind SQL injection vulnerability. • https://www.exploit-db.com/exploits/21546 http://esupport.trendmicro.com/solution/en-us/1061043.aspx http://jvn.jp/en/jp/JVN42014489/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000090 http://www.kb.cert.org/vuls/id/950795 http://www.securitytracker.com/id?1027584 http://www.spentera.com/2012/09/trend-micro-control-manager-sql-injection-vulnerability http://www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_TMCM55_1823.txt http://www.trendmicro.com/ftp/doc • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.3EPSS: 39%CPEs: 118EXPL: 0CVE-2007-0851
https://notcve.org/view.php?id=CVE-2007-0851
Buffer overflow in the Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00, as used in other products such as Cyber Clean Center (CCC) Cleaner, allows remote attackers to execute arbitrary code via a malformed UPX compressed executable. Un desbordamiento de búfer en Trend Micro Scan Engine versiones 8.000 y 8.300 anteriores al archivo de patrones de virus versión 4.245.00, tal y como es usado en otros productos como Cyber Clean Center (CCC) Cleaner, permite a atacantes remotos ejecutar código arbitrario por medio de un ejecutable comprimido UPX malformado. • http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034289 http://jvn.jp/jp/JVN%2377366274/index.html http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=470 http://osvdb.org/33038 http://secunia.com/advisories/24087 http://secunia.com/advisories/24128 http://securitytracker.com/id?1017601 http://securitytracker.com/id?1017602 http://securitytracker.com/id? •