CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49214
https://notcve.org/view.php?id=CVE-2025-49214
17 Jun 2025 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-477: Use of Obsolete Function •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49211 – Trend Micro Endpoint Encryption BuildEnterpriseSearchString SQL Injection Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2025-49211
11 Jun 2025 — A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro Endpoint Encryption. Although authentication is required to exploit this vulnerability, the existing authentica... • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49212 – Trend Micro Endpoint Encryption DeserializeFromBase64String Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49212
11 Jun 2025 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Endpoint Encryption. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypasse... • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-477: Use of Obsolete Function •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49213 – Trend Micro Endpoint Encryption PolicyServerWindowsService Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49213
11 Jun 2025 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Endpoint Encryption. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PolicyServerWindowsSe... • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-477: Use of Obsolete Function •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49215 – Trend Micro Endpoint Encryption GetGroupFilteredUsers SQL Injection Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2025-49215
11 Jun 2025 — A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro Endpoint Encryption. Although authentication is required to exploit this vulnerability, the existing ... • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-242: Use of Inherently Dangerous Function •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49216 – Trend Micro Endpoint Encryption DbAppDomain Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2025-49216
11 Jun 2025 — An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations. This vulnerability allows remote attackers to bypass authentication on affected installations of Trend Micro Endpoint Encryption. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DbAppDomain service. The issue results from an improper implementatio... • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-477: Use of Obsolete Function •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49217 – Trend Micro Endpoint Encryption ValidateToken Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49217
11 Jun 2025 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Endpoint Encryption. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the... • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-477: Use of Obsolete Function •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49218 – Trend Micro Endpoint Encryption ProcessWhereClause SQL Injection Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2025-49218
11 Jun 2025 — A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro Endpoint Encryption. Although authentication... • https://success.trendmicro.com/en-US/solution/KA-0019928 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •