CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-37347 – Trend Micro Maximum Security Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-37347
Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the same as CVE-2022-35234. Trend Micro Security versiones 2021 y 2022 (Consumer) es susceptible a una Vulnerabilidad de Divulgación de Información de Lectura Fuera de Límites que podría permitir a un atacante leer información confidencial de otras ubicaciones de memoria y causar un bloqueo en un equipo afectado. Esta vulnerabilidad es similar, pero no igual, a CVE-2022-35234 This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the User Mode Hooking Monitor Engine. • https://helpcenter.trendmicro.com/en-us/article/tmka-11058 https://www.zerodayinitiative.com/advisories/ZDI-22-1176 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-37348 – Trend Micro Maximum Security Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-37348
Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the same as CVE-2022-37347. Trend Micro Security versiones 2021 y 2022 (Consumer) es vulnerable a una Vulnerabilidad de Divulgación de Información de Lectura Fuera de Límites que podría permitir a un atacante leer información confidencial de otras ubicaciones de memoria y causar un bloqueo en un equipo afectado. Esta vulnerabilidad es similar, pero no igual, a CVE-2022-37347 This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the User Mode Hooking Monitor Engine. • https://helpcenter.trendmicro.com/en-us/article/tmka-11058 https://www.zerodayinitiative.com/advisories/ZDI-22-1177 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-34893 – Trend Micro Maximum Security Link Following Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-34893
Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine. Trend Micro Security versión 2022 (consumer), presenta una vulnerabilidad de tipo link following en la que un atacante con bajos privilegios podría manipular un punto de montaje que podría conllevar a una escalada de privilegios en una máquina afectada This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Trend Micro Anti-Malware Solution Platform. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://helpcenter.trendmicro.com/en-us/article/tmka-11053 https://www.zerodayinitiative.com/advisories/ZDI-22-1175 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 84EXPL: 1CVE-2022-23120
https://notcve.org/view.php?id=CVE-2022-23120
A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to escalate privileges and run arbitrary code in the context of root. Please note: an attacker must first obtain access to the target agent in an un-activated and unconfigured state in order to exploit this vulnerability. Una vulnerabilidad de inyección de código en Trend Micro Deep Security y Cloud One - Workload Security Agent para Linux versión 20 y anteriores, podría permitir a un atacante escalar privilegios y ejecutar código arbitrario en el contexto de root. Nota: un atacante debe obtener primero acceso al agente de destino en un estado no activado y no configurado para poder explotar esta vulnerabilidad • https://success.trendmicro.com/solution/000290104 https://www.modzero.com/advisories/MZ-21-02-Trendmicro.txt • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 1CVE-2022-23119
https://notcve.org/view.php?id=CVE-2022-23119
A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to read arbitrary files from the file system. Please note: an attacker must first obtain compromised access to the target Deep Security Manager (DSM) or the target agent must be not yet activated or configured in order to exploit this vulnerability. Una vulnerabilidad de salto de directorio en Trend Micro Deep Security y Cloud One - Workload Security Agent para Linux versión 20 y anteriores, podría permitir a un atacante leer archivos arbitrarios del sistema de archivos. Nota: un atacante debe obtener primero un acceso comprometido al Deep Security Manager (DSM) de destino o el agente de destino no debe estar aún activado o configurado para poder explotar esta vulnerabilidad • https://success.trendmicro.com/solution/000290104 https://www.modzero.com/advisories/MZ-21-02-Trendmicro.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •