Trendmicro

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-11390 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706.
CVE-2017-11389 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684.
CVE-2017-11388 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and...Show more SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.Show less
CVE-2017-11387 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can change debug logging level. Formerly ZDI-CAN-4512.
CVE-2017-11386 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.
CVE-2017-11385 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHandlerStatusMonitor.dll. Formerly ZDI-CAN-4545.
CVE-2017-11384 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll. Formerly ZDI-CAN-4561.
CVE-2017-11383 1Trendmicro 1Control Manager May 13, 2026 Aug 2, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHandlerTVCSCommander.dll. Formerly ZDI-CAN-4560.
CVE-2017-11381 1Trendmicro 1Deep Discovery Director May 13, 2026 Aug 1, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.
CVE-2017-11380 1Trendmicro 1Deep Discovery Director May 13, 2026 Aug 1, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1.
CVE-2017-11379 1Trendmicro 1Deep Discovery Director May 13, 2026 Aug 1, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1.
CVE-2017-9037 1Trendmicro 1Serverprotect May 13, 2026 May 26, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) S44, (2) S5, (3) S_action_fail, (4)...Show more Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) S44, (2) S5, (3) S_action_fail, (4) S_ptn_update, (5) T113, (6) T114, (7) T115, (8) T117117, (9) T118, (10) T_action_fail, (11) T_ptn_update, (12) textarea, (13) textfield5, or (14) tmLastConfigFileModifiedDate parameter to notification.cgi.Show less
CVE-2017-9036 1Trendmicro 1Serverprotect May 13, 2026 May 26, 2017 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory.
CVE-2017-9035 1Trendmicro 1Serverprotect May 13, 2026 May 26, 2017 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.
CVE-2017-9034 1Trendmicro 1Serverprotect May 13, 2026 May 26, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges by leveraging failure to validate software updates.
CVE-2017-9033 1Trendmicro 1Serverprotect May 13, 2026 May 26, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary so...Show more Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens.Show less
CVE-2017-9032 1Trendmicro 1Serverprotect May 13, 2026 May 26, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) T1 or (2) tmLastConfigFileModifiedDa...Show more Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) T1 or (2) tmLastConfigFileModifiedDate parameter to log_management.cgi.Show less
CVE-2017-8801 1Trendmicro 1Officescan May 13, 2026 May 5, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Trend Micro OfficeScan 11.0 before SP1 CP 6325 (with Agent Module Build before 6152) and XG before CP 1352 has XSS via a crafted URI using a blocked website.
CVE-2017-5481 1Trendmicro 1Officescan May 13, 2026 May 3, 2017 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a leak of an encrypted password during a web-console operation.
CVE-2016-8593 1Trendmicro 1Threat Discovery Appliance May 13, 2026 Apr 28, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.

Previous 1...242526 27 28 Next