Trend Micro Vulnerabilities and Affected Products
Vulnerabilities associated with Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA).
Products
Clear product- Trend Micro Apex One81 vulnerabilities
- Trend Micro OfficeScan53 vulnerabilities
- Trend Micro Worry-Free Business Security46 vulnerabilities
- Trend Micro Security (Consumer)27 vulnerabilities
- Trend Micro Email Encryption Gateway18 vulnerabilities
- Trend Micro InterScan Web Security Virtual Appliance16 vulnerabilities
- Trend Micro Antivirus for Mac (Consumer)12 vulnerabilities
- Trend Micro Control Manager11 vulnerabilities
- Trend Micro Password Manager10 vulnerabilities
- Trend Micro Deep Security8 vulnerabilities
- Trend Micro Smart Protection Server (Standalone)8 vulnerabilities
- Trend Micro HouseCall for Home Networks6 vulnerabilities
- Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)6 vulnerabilities
- Trend Micro Maximum Security6 vulnerabilities
- Trend Micro Antivirus for Mac5 vulnerabilities
- Trend Micro Home Network Security5 vulnerabilities
- Trend Micro ServerProtect for Linux5 vulnerabilities
- Trend Micro ServerProtect for EMC Celerra4 vulnerabilities
- Trend Micro ServerProtect for Microsoft Windows / Novell NetWare4 vulnerabilities
- Trend Micro ServerProtect for Network Appliance Filers4 vulnerabilities
- Trend Micro ServerProtect for Storage4 vulnerabilities
- Apex One and Apex One as a Service3 vulnerabilities
- Mobile Security (Enterprise)3 vulnerabilities
- Trend Micro Anti-Threat Toolkit (ATTK)3 vulnerabilities
- Trend Micro InterScan Messaging Security Virtual Appliance3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2020-27019MEDIUM | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key. | CVSS5.5v3.1 | EPSS18.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27694HIGH | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack. Nov 9, 2020 | CVSS8.8v3.1 | EPSS7.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27693MEDIUM | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated. CWE-916Nov 9, 2020 | CVSS4.4v3.1 | EPSS1.78% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27018MEDIUM | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have obtained authenticated privileges on the product to exploit this vulnerability. CWE-918Nov 9, 2020 | CVSS5.5v3.1 | EPSS3.51% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27017MEDIUM | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability. | CVSS4.9v3.1 | EPSS6.47% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27016HIGH | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability. CWE-352Nov 9, 2020 | CVSS8.8v3.1 | EPSS1.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |