Vulnerabilities > Trendmicro > High

DATE CVE VULNERABILITY TITLE RISK
2024-01-23 CVE-2023-52324 Unrestricted Upload of File with Dangerous Type vulnerability in Trendmicro Apex Central 2019
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials.
network
low complexity
trendmicro CWE-434
8.8
2024-01-23 CVE-2023-52325 Unspecified vulnerability in Trendmicro Apex Central 2019
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations. Please note: this vulnerability must be used in conjunction with another one to exploit an affected system.
network
high complexity
trendmicro
7.5
2024-01-23 CVE-2023-52331 Server-Side Request Forgery (SSRF) vulnerability in Trendmicro Apex Central 2019
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
network
low complexity
trendmicro CWE-918
7.1
2024-01-23 CVE-2023-52337 Unspecified vulnerability in Trendmicro Deep Security and Deep Security Agent
An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
local
low complexity
trendmicro
7.8
2024-01-23 CVE-2023-52338 Link Following vulnerability in Trendmicro Deep Security and Deep Security Agent
A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
local
low complexity
trendmicro CWE-59
7.8
2023-09-19 CVE-2023-41179 Unspecified vulnerability in Trendmicro products
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
network
low complexity
trendmicro
7.2
2023-06-26 CVE-2023-28929 Uncontrolled Search Path Element vulnerability in Trendmicro products
Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started.
local
low complexity
trendmicro CWE-427
7.8
2023-06-26 CVE-2023-32522 Path Traversal vulnerability in Trendmicro Mobile Security 9.8
A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote attacker to delete arbitrary files. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
network
low complexity
trendmicro CWE-22
8.1
2023-06-26 CVE-2023-32523 Improper Authentication vulnerability in Trendmicro Mobile Security 9.8
Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This is similar to, but not identical to CVE-2023-32524.
network
low complexity
trendmicro CWE-287
8.8
2023-06-26 CVE-2023-32524 Improper Authentication vulnerability in Trendmicro Mobile Security 9.8
Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This is similar to, but not identical to CVE-2023-32523.
network
low complexity
trendmicro CWE-287
8.8