Trendmicro vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-0587 A file upload vulnerability in exists in Trend Micro Apex One server build 11110.Critical 9.1 · Jan 31, 2023
• CVE-2017-14092 The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an aHigh 8.8 · Dec 15, 2017
• CVE-2017-14081 Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary codeHigh 8.8 · Sep 22, 2017
• CVE-2016-6220 Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0.High 7.5 · Aug 7, 2017
• CVE-2017-11390 XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure.High 7.5 · Aug 2, 2017
• CVE-2017-11389 Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing direCritical 9.8 · Aug 2, 2017
• CVE-2017-11388 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided stringsHigh 8.8 · Aug 2, 2017
• CVE-2017-11387 Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can chaHigh 7.5 · Aug 2, 2017
• CVE-2017-11386 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHanCritical 9.8 · Aug 2, 2017
• CVE-2017-11385 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHanCritical 9.8 · Aug 2, 2017
• CVE-2017-11384 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandCritical 9.8 · Aug 2, 2017
• CVE-2017-11383 SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHanCritical 9.8 · Aug 2, 2017
• CVE-2017-9036 Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory.High 7.8 · May 25, 2017
• CVE-2017-9035 Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with updatHigh 7.4 · May 25, 2017
• CVE-2017-9034 Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privilegesCritical 9.8 · May 25, 2017
• CVE-2017-9033 Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication oHigh 8.8 · May 25, 2017
• CVE-2017-5481 Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a leak of an encrypted pHigh 8.8 · May 3, 2017
• CVE-2016-8593 Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arHigh 8.8 · Apr 28, 2017
• CVE-2016-8592 log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root usHigh 8.8 · Apr 28, 2017
• CVE-2016-8591 log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via High 8.8 · Apr 28, 2017
• CVE-2016-8590 log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user High 8.8 · Apr 28, 2017
• CVE-2016-8589 log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user High 8.8 · Apr 28, 2017
• CVE-2016-8588 The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metHigh 7.3 · Apr 28, 2017
• CVE-2016-8587 dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archivHigh 7.3 · Apr 28, 2017
• CVE-2016-8586 detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as theHigh 8.8 · Apr 28, 2017