Trendmicro Apex One vulnerabilities

CVE-2023-52330 [MEDIUM] CWE-79 CVE-2023-52330: A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to ex A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central. Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

CVE-2023-41179 [HIGH] CWE-94 CVE-2023-41179: A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem an A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console ac

CVE-2023-32557 [CRITICAL] CWE-22 CVE-2023-32557: A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges.

CVE-2023-34145 [HIGH] CVE-2023-34145: An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service securit An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar,

CVE-2023-34147 [HIGH] CVE-2023-34147: An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service se An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target s

CVE-2023-34148 [HIGH] CVE-2023-34148: An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service se An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target s

CVE-2023-34144 [HIGH] CWE-426 CVE-2023-34144: An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service securit An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a s

CVE-2023-34146 [HIGH] CWE-269 CVE-2023-34146: An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service se An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the

CVE-2023-32554 [HIGH] CWE-367 CVE-2023-32554: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agen A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to

CVE-2023-32555 [HIGH] CVE-2023-32555: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agen A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but no

CVE-2023-30902 [MEDIUM] CWE-276 CVE-2023-30902: A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent cou A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privileged Trend Micro registry keys including its own protected registry keys on affected installations.

CVE-2023-32552 [MEDIUM] CWE-281 CVE-2023-32552: An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could all An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32553

CVE-2023-32556 [MEDIUM] CWE-59 CVE-2023-32556: A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could all A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2023-32553 [MEDIUM] CVE-2023-32553: An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could all An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32552.

CVE-2023-25143 [CRITICAL] CWE-427 CVE-2023-25143: An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected products.

CVE-2023-25146 [HIGH] CWE-59 CVE-2023-25146: A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder and replace with a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to an arbitrary location. Please note: an attacker must first obtain the ability to execute lo

CVE-2023-25144 [HIGH] CWE-269 CVE-2023-25144: An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attac An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary directories with arbitrary ownership.

CVE-2023-25145 [HIGH] CWE-59 CVE-2023-25145: A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2023-25148 [HIGH] CWE-59 CVE-2023-25148: A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker t A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order t

CVE-2023-25147 [MEDIUM] CWE-427 CVE-2023-25147: An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired admin An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on the target system via another method in order to explo