Trendmicro Threat Discovery Appliance vulnerabilities
12 known vulnerabilities affecting trendmicro/threat_discovery_appliance.
Total CVEs
12
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH9
Vulnerabilities
Page 1 of 1
CVE-2016-8584CRITICALCVSS 9.8≤ 2.6.10622017-04-28
CVE-2016-8584 [CRITICAL] CWE-284 CVE-2016-8584: Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which
Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
nvd
CVE-2016-8592HIGHCVSS 8.8≤ 2.6.10622017-04-28
CVE-2016-8592 [HIGH] CWE-264 CVE-2016-8592: log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote
log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
nvd
CVE-2016-8591HIGHCVSS 8.8≤ 2.6.10622017-04-28
CVE-2016-8591 [HIGH] CWE-264 CVE-2016-8591: log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authent
log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
nvd
CVE-2016-8587HIGHCVSS 7.3≤ 2.6.10622017-04-28
CVE-2016-8587 [HIGH] CWE-284 CVE-2016-8587: dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote
dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
nvd
CVE-2016-8586HIGHCVSS 8.8≤ 2.6.10622017-04-28
CVE-2016-8586 [HIGH] CWE-264 CVE-2016-8586: detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows
detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
nvd
CVE-2016-8588HIGHCVSS 7.3≤ 2.6.10622017-04-28
CVE-2016-8588 [HIGH] CWE-284 CVE-2016-8588: The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
nvd
CVE-2016-8593HIGHCVSS 8.8≤ 2.6.10622017-04-28
CVE-2016-8593 [HIGH] CWE-22 CVE-2016-8593: Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
nvd
CVE-2016-8590HIGHCVSS 8.8≤ 2.6.10622017-04-28
CVE-2016-8590 [HIGH] CWE-264 CVE-2016-8590: log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote aut
log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
nvd
CVE-2016-8585HIGHCVSS 8.8≤ 2.6.10622017-04-28
CVE-2016-8585 [HIGH] CWE-264 CVE-2016-8585: admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote au
admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
nvd
CVE-2016-8589HIGHCVSS 8.8≤ 2.6.10622017-04-28
CVE-2016-8589 [HIGH] CWE-264 CVE-2016-8589: log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote aut
log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
nvd
CVE-2016-7547CRITICALCVSS 9.8PoCv2.6.10622017-04-12
CVE-2016-7547 [CRITICAL] CWE-361 CVE-2016-7547: A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the ti
A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.
nvd
CVE-2016-7552CRITICALCVSS 9.8PoCv2.6.10622017-04-12
CVE-2016-7552 [CRITICAL] CWE-22 CVE-2016-7552: On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a sess
On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
nvd