Trendmicro Interscan Web Security Virtual Appliance vulnerabilities
29 vulnerabilities
Known vulnerabilities in Trendmicro Interscan Web Security Virtual Appliance, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-31521trend microtrend micro interscan web security virtual appliance+1
EPSS score1.40%
Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captive Portal.CVE-2021-25252trend microtrend micro virus scan api (vsapi) engine+19EPSS score0.62%
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.CVE-2016-9269trendmicrointerscan_web_security_virtual_applianceEPSS score13.42%
Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737.CVE-2016-9315trendmicrointerscan_web_security_virtual_applianceEPSS score8.98%
Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or add new admin accounts. This was resolved in Version 6.5 CP 1737.CVE-2016-9316trendmicrointerscan_web_security_virtual_applianceEPSS score2.77%
Multiple stored Cross-Site-Scripting (XSS) vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary HTML/JavaScript code into web pages. This was resolved in Version 6.5 CP 1737.CVE-2016-9314trendmicrointerscan_web_security_virtual_applianceEPSS score3.02%
Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to backup the system configuration and download it onto their local machine. This backup file contains sensitive information like passwd/shadow files, RSA certificates, Private Keys and Default Passphrase, etc. This was resolved in Version 6.5 CP 1737.CVE-2020-27010trend microtrend micro interscan web security virtual appliance+1EPSS score0.72%
A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper with the web interface of the product in a manner separate from the similar CVE-2020-8462.CVE-2020-28581trend microtrend micro interscan web security virtual appliance+1EPSS score44.95%
A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.CVE-2020-28579trend microtrend micro interscan web security virtual appliance+1EPSS score50.73%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.CVE-2020-28580trend microtrend micro interscan web security virtual appliance+1EPSS score44.95%
A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.CVE-2020-28578trend microtrend micro interscan web security virtual appliance+1EPSS score73.05%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.CVE-2020-8606trend microtrend micro interscan web security virtual appliance+1EPSS score73.30%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.CVE-2020-8463trend microtrend micro interscan web security virtual appliance+1EPSS score5.98%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization check for anonymous users by manipulating request paths.CVE-2020-8461trend microtrend micro interscan web security virtual appliance+1EPSS score1.15%
A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token.CVE-2020-8603trend microtrend micro interscan web security virtual appliance+1EPSS score1.98%
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.CVE-2020-8464trend microtrend micro interscan web security virtual appliance+1EPSS score6.42%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product's admin interface to users who would not normally have access.CVE-2020-8466trend microtrend micro interscan web security virtual appliance+1EPSS score64.08%
A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.CVE-2020-8604trend microtrend micro interscan web security virtual appliance+1EPSS score89.77%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.CVE-2020-8605trend microtrend micro interscan web security virtual appliance+1EPSS score87.76%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.CVE-2020-8465trend microtrend micro interscan web security virtual appliance+1EPSS score2.69%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass (CVE-2020-8461) and authentication bypass (CVE-2020-8464) to execute code as user root.