Trendmicro Threat Discovery Appliance vulnerabilities
12 vulnerabilities
Known vulnerabilities in Trendmicro Threat Discovery Appliance, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2016-7547trendmicrothreat_discovery_appliance
EPSS score92.72%
A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.CVE-2016-7552trendmicrothreat_discovery_applianceEPSS score93.25%
On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.CVE-2016-8591trendmicrothreat_discovery_applianceEPSS score6.25%
log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.CVE-2016-8593trendmicrothreat_discovery_applianceEPSS score7.05%
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.CVE-2016-8592trendmicrothreat_discovery_applianceEPSS score6.25%
log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.CVE-2016-8585trendmicrothreat_discovery_applianceEPSS score7.20%
admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.CVE-2016-8586trendmicrothreat_discovery_applianceEPSS score6.12%
detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.CVE-2016-8588trendmicrothreat_discovery_applianceEPSS score2.22%
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.CVE-2016-8587trendmicrothreat_discovery_applianceEPSS score2.45%
dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.CVE-2016-8589trendmicrothreat_discovery_applianceEPSS score5.74%
log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.CVE-2016-8584trendmicrothreat_discovery_applianceEPSS score5.57%
Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.CVE-2016-8590trendmicrothreat_discovery_applianceEPSS score5.74%
log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.