Trend Micro Vulnerabilities and Affected Products
Vulnerabilities associated with Trend Micro InterScan Web Security Virtual Appliance.
Products
Clear product- Trend Micro Apex One81 vulnerabilities
- Trend Micro OfficeScan53 vulnerabilities
- Trend Micro Worry-Free Business Security46 vulnerabilities
- Trend Micro Security (Consumer)27 vulnerabilities
- Trend Micro Email Encryption Gateway18 vulnerabilities
- Trend Micro InterScan Web Security Virtual Appliance16 vulnerabilities
- Trend Micro Antivirus for Mac (Consumer)12 vulnerabilities
- Trend Micro Control Manager11 vulnerabilities
- Trend Micro Password Manager10 vulnerabilities
- Trend Micro Deep Security8 vulnerabilities
- Trend Micro Smart Protection Server (Standalone)8 vulnerabilities
- Trend Micro HouseCall for Home Networks6 vulnerabilities
- Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)6 vulnerabilities
- Trend Micro Maximum Security6 vulnerabilities
- Trend Micro Antivirus for Mac5 vulnerabilities
- Trend Micro Home Network Security5 vulnerabilities
- Trend Micro ServerProtect for Linux5 vulnerabilities
- Trend Micro ServerProtect for EMC Celerra4 vulnerabilities
- Trend Micro ServerProtect for Microsoft Windows / Novell NetWare4 vulnerabilities
- Trend Micro ServerProtect for Network Appliance Filers4 vulnerabilities
- Trend Micro ServerProtect for Storage4 vulnerabilities
- Apex One and Apex One as a Service3 vulnerabilities
- Mobile Security (Enterprise)3 vulnerabilities
- Trend Micro Anti-Threat Toolkit (ATTK)3 vulnerabilities
- Trend Micro InterScan Messaging Security Virtual Appliance3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-31521MEDIUM | Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captive Portal. CWE-79Jun 17, 2021 | CVSS5.4v3.1 | EPSS1.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8466CRITICAL | A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password. | CVSS9.8v3.1 | EPSS63.7% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8465CRITICAL | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass (CVE-2020-8461) and authentication bypass (CVE-2020-8464) to execute code as user root. | CVSS9.8v3.1 | EPSS2.57% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8463HIGH | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization check for anonymous users by manipulating request paths. | CVSS7.5v3.1 | EPSS5.91% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8464HIGH | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product's admin interface to users who would not normally have access. CWE-918Dec 17, 2020 | CVSS7.5v3.1 | EPSS6.34% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8462MEDIUM | A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper with the web interface of the product. CWE-79Dec 17, 2020 | CVSS4.8v3.1 | EPSS1.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8461HIGH | A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token. CWE-352Dec 17, 2020 | CVSS8.8v3.1 | EPSS1.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27010MEDIUM | A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper with the web interface of the product in a manner separate from the similar CVE-2020-8462. CWE-79Dec 17, 2020 | CVSS4.8v3.1 | EPSS0.713% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-28581HIGH | A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. CWE-78Nov 18, 2020 | CVSS7.2v3.1 | EPSS45% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-28580HIGH | A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. CWE-78Nov 18, 2020 | CVSS7.2v3.1 | EPSS45% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-28579HIGH | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. CWE-787Nov 18, 2020 | CVSS8.8v3.1 | EPSS50.7% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-28578CRITICAL | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. CWE-787Nov 18, 2020 | CVSS9.8v3.1 | EPSS73.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8606CRITICAL | Trend Micro Web Security (Virtual Appliance) Remote Code ExecutionA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance. CWE-287May 27, 2020 | CVSS9.8v3.1 | EPSS72.7% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8604HIGH | Trend Micro Web Security (Virtual Appliance) Remote Code ExecutionA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations. | CVSS7.5v3.1 | EPSS89.8% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8605HIGH | Trend Micro Web Security Virtual Appliance 6.5 SP2 Patch 4 Build 1901 - Remote Code Execution (Metasploit)A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability. CWE-78May 27, 2020 | CVSS8.8v3.1 | EPSS87.8% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8603MEDIUM | A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. CWE-79May 27, 2020 | CVSS6.1v3.1 | EPSS1.98% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |