CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25772 – Trend Micro Apex One scanServer64 Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-25772
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771. Una vulnerabilidad de divulgación de información de lectura fuera de límites en Trend Micro Apex One, puede permitir a un atacante local divulgar información confidencial a una cuenta poco privilegiada en instalaciones vulnerables del producto. Un atacante primero debe obtener la capacidad de ejecutar código poco privilegiado sobre el objetivo a fin de explotar estas vulnerabilidades. • https://success.trendmicro.com/solution/000271974 https://www.zerodayinitiative.com/advisories/ZDI-20-1222 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-24560
https://notcve.org/view.php?id=CVE-2020-24560
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-295: Improper server certificate verification in the communication with the update server. Una vulnerabilidad de comprobación de certificación de servidor SSL incompleta en la familia de productos de consumidor Trend Micro Security 2019 versión (v15), podría permitir a un atacante combinar esta vulnerabilidad con otro ataque para engañar a un cliente afectado para que descargue una actualización maliciosa en lugar de la esperada. CWE-295: Comprobación inapropiada del certificado del servidor en la comunicación con el servidor de actualización. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09890 https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673 https://jvn.jp/en/jp/JVN60093979 https://jvn.jp/jp/JVN60093979 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15604
https://notcve.org/view.php?id=CVE-2020-15604
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-494: Update files are not properly verified. Una vulnerabilidad de comprobación de certificación de servidor SSL incompleta en la familia de productos de consumo Trend Micro Security 2019 versión (v15), podría permitir a un atacante combinar esta vulnerabilidad con otro ataque para engañar a un cliente afectado para que descargue una actualización maliciosa en lugar de la prevista. CWE-494: Los archivos de actualización no se comprobaron apropiadamente. • https://helpcenter.trendmicro.com/en-us/article/TMKA-09890 https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673 https://jvn.jp/en/jp/JVN60093979 https://jvn.jp/jp/JVN60093979 • CWE-295: Improper Certificate Validation CWE-494: Download of Code Without Integrity Check •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24561
https://notcve.org/view.php?id=CVE-2020-24561
A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attacker must first obtain admin/root privileges on the SPLX console to exploit this vulnerability. Una vulnerabilidad de inyección de comandos en Trend Micro ServerProtect para Linux versión 3.0, podría permitir a un atacante ejecutar código arbitrario en un sistema afectado. Un atacante debe primero obtener privilegios admin/root en la consola SPLX para explotar esta vulnerabilidad • https://success.trendmicro.com/solution/000268419 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-24558 – Trend Micro Apex One Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-24558
A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an attacker to manipulate it to cause an out-of-bounds read that crashes multiple processes in the product. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad en una dll de Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 y Worry-Free Business Security Services dll, puede permitir a un atacante manipularla para causar una lectura fuera de límites que bloquee varios procesos en el producto. Un atacante debe primero obtener la capacidad de ejecutar código poco privilegiado en el sistema de objetivo para explotar esta vulnerabilidad This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Apex One. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within OfcPIPC_64x.dll. • https://success.trendmicro.com/solution/000263632 https://success.trendmicro.com/solution/000267260 https://www.zerodayinitiative.com/advisories/ZDI-20-1095 • CWE-125: Out-of-bounds Read •