CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-44652 – Trend Micro Apex One Improper Handling of Exceptional Conditions Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-44652
An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Un manejo inadecuado de la vulnerabilidad de condiciones excepcionales en Trend Micro Apex One y Apex One as a Service podría permitir a un atacante local escalar privilegios en las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad. This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer. • https://success.trendmicro.com/solution/000291770 https://www.zerodayinitiative.com/advisories/ZDI-22-1621 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-44651 – Trend Micro Apex One Security Agent Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-44651
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad de Time-of-Check Time-Of-Use en Trend Micro Apex One y Apex One como agente de servicio podría permitir a un atacante local escalar privilegios en las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad. This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One Client Plug-in Service Manager. • https://success.trendmicro.com/solution/000291770 https://www.zerodayinitiative.com/advisories/ZDI-22-1620 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-44653 – Trend Micro Apex One Security Agent Directory Traversal Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-44653
A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad de directory traversal del agente de seguridad en Trend Micro Apex One y Apex One as a Service podría permitir a un atacante local escalar privilegios en las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad. This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One Client Plug-in Service Manager. • https://success.trendmicro.com/solution/000291770 https://www.zerodayinitiative.com/advisories/ZDI-22-1622 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-44650 – Trend Micro Apex One Unauthorized Change Prevention Service Memory Corruption Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-44650
A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Una vulnerabilidad de corrupción de memoria en el servicio de Prevención de Cambios No Autorizados de Trend Micro Apex One y Apex One as a Service podría permitir a un atacante local elevar los privilegios en las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad. This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Unauthorized Change Prevention Service. • https://success.trendmicro.com/solution/000291770 https://www.zerodayinitiative.com/advisories/ZDI-22-1616 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-44647 – Trend Micro Apex One Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-44647
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not the same as CVE-2022-44648. Una vulnerabilidad de lectura fuera de los límites en Trend Micro Apex One y Apex One as a Service podría permitir a un atacante local revelar información confidencial sobre las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad. Esto es similar, pero no igual, a CVE-2022-44648. This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Apex One Security Agent. • https://success.trendmicro.com/solution/000291770 https://www.zerodayinitiative.com/advisories/ZDI-22-1617 • CWE-125: Out-of-bounds Read •