CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-9315 – Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2016-9315
Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or add new admin accounts. This was resolved in Version 6.5 CP 1737. Vulnerabilidad de escalada de privilegios en com.trend.iwss.gui.servlet.updateaccountadministration en Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versión 6.5-SP2_Build_Linux_1707 y versiones anteriores permite a usuarios remotos autenticados con menos privilegios cambiar la contraseña del administrador Master y/o añadir nuevas cuentas de administrador. Esto se resolvió en Version 6.5 CP 1737. Trendmicro InterScan version 6.5-SP2_Build_Linux_1548 suffers from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/41361 http://www.securityfocus.com/bid/96252 http://www.securitytracker.com/id/1037849 https://success.trendmicro.com/solution/1116672 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-8510 – Trend Micro InterScan Web Security Virtual Appliance Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-8510
The AdminUI in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) before 6.0 HF build 1244 allows remote authenticated users to read arbitrary files via vectors related to configuration input when saving filters. La interfaz de usuarios de administración en Trend Micro InterScan Web Security Virtual Appliance (IWSVA) anterior a 6.0 HF build 1244 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de vectores relacionados con entradas de configuraciones cuando se guardan filtros. This vulnerability allows remote attackers to read files from the underlying operating system on vulnerable installations of Trend Micro InterScan Web Security Virtual Appliance web application authentication is required to exploit this vulnerability. The specific flaw exists within multiple areas of the AdminUI. The issue lies in the handling of configuration input due to a failure to safely sanitize user data before saving filters. An attacker could leverage this vulnerability to read any file to which the web app has read access. • http://www.zerodayinitiative.com/advisories/ZDI-14-373 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2009-0612
https://notcve.org/view.php?id=CVE-2009-0612
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header. Trend Micro InterScan Web Security Virtual Appliance (IWSVA) v3.x e InterScan Web Security Suite (IWSS) v3.x, cuando la autorización básica está habilitada sobre el proxy independiente, reenvía la cabecera de autorización del proxy desde Windows Media Player, lo que permite a servidores Web remotos obtener credenciales ofreciendo una secuencia "media" y capturando esta cabecera. • http://secunia.com/advisories/33891 http://www.securityfocus.com/archive/1/500760/100/0/threaded http://www.securityfocus.com/bid/33687 http://www.securitytracker.com/id?1021716 https://exchange.xforce.ibmcloud.com/vulnerabilities/48681 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •