Vulnerabilities > Trendmicro > Apex ONE

DATE CVE VULNERABILITY TITLE RISK
2023-09-19 CVE-2023-41179 Unspecified vulnerability in Trendmicro products
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
network
low complexity
trendmicro
7.2
2023-06-26 CVE-2023-30902 Unspecified vulnerability in Trendmicro Apex ONE 14.0.10349/2019
A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privileged Trend Micro registry keys including its own protected registry keys on affected installations.
local
low complexity
trendmicro
5.5
2023-06-26 CVE-2023-32552 Unspecified vulnerability in Trendmicro Apex ONE 14.0.10349/2019
An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32553
network
low complexity
trendmicro
5.3
2023-06-26 CVE-2023-32553 Unspecified vulnerability in Trendmicro Apex ONE 14.0.10349/2019
An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32552.
network
low complexity
trendmicro
5.3
2023-06-26 CVE-2023-32554 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Trendmicro Apex ONE 14.0.10349/2019
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32555.
local
high complexity
trendmicro CWE-367
7.0
2023-06-26 CVE-2023-32555 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Trendmicro Apex ONE 14.0.10349/2019
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32554.
local
high complexity
trendmicro CWE-367
7.0
2023-06-26 CVE-2023-32556 Link Following vulnerability in Trendmicro Apex ONE 14.0.10349/2019
A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
local
low complexity
trendmicro CWE-59
5.5
2023-06-26 CVE-2023-32557 Path Traversal vulnerability in Trendmicro Apex ONE 14.0.10349/2019
A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges.
network
low complexity
trendmicro CWE-22
critical
9.8
2023-06-26 CVE-2023-34144 Untrusted Search Path vulnerability in Trendmicro Apex ONE 14.0.10349/2019
An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34145.
local
low complexity
trendmicro CWE-426
7.8
2023-06-26 CVE-2023-34145 Untrusted Search Path vulnerability in Trendmicro Apex ONE 14.0.10349/2019
An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34144.
local
low complexity
trendmicro CWE-426
7.8