Trend Micro, Inc. vulnerabilities
Published CVEs affecting Trend Micro, Inc. products: 30 record(s), with severity, exploitation and fixes.
Apex One 26TrendAI Apex One 12TrendAI Apex One as a Service 12Officescan 6Worry-free Business Security 5Trend Micro Apex Central 4TrendAI Apex One (Mac) 4Officescan Business Security 2Trend Micro OfficeScan, Trend Micro Apex One 2Worry-free Business Security Services 1Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS) 1
CVE-2020-24557
High · 7.8
KEV High · 54 Sep 1, 2020
Trend Micro Multiple Products Improper Access Control Vulnerability
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.
CVE-2020-8599
Critical · 9.8
KEV High · 62 Mar 17, 2020
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
CVE-2020-8468
High · 8.8
KEV High · 68 CWE-74 Mar 17, 2020
Trend Micro Multiple Products Content Validation Escape Vulnerability
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
CVE-2020-8467
High · 8.8
KEV High · 55 Mar 17, 2020
Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
CVE-2019-18187
High · 7.5
KEV High · 56 CWE-22 Oct 28, 2019
Trend Micro OfficeScan Directory Traversal Vulnerability
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.