Trend Micro Interscan Messaging Security Virtual Appliance vulnerabilities

13 CVEs affecting Trend Micro Interscan Messaging Security Virtual Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-25252, published 2021-03-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-11391, published 2017-08-03. High severity, CVSS 8.8. EPSS: 62.1% chance of exploitation in the next 30 days. Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw…
CVE-2017-6398, published 2017-03-14. High severity, CVSS 8.8. EPSS: 54.1% chance of exploitation in the next 30 days. An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is…
CVE-2017-11392, published 2017-08-03. High severity, CVSS 8.8. EPSS: 34.1% chance of exploitation in the next 30 days. Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw…
CVE-2018-3609, published 2018-02-16. High severity, CVSS 8.1. EPSS: 21.4% chance of exploitation in the next 30 days. A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log…
CVE-2020-27019, published 2020-11-09. Medium severity, CVSS 5.5. EPSS: 17.9% chance of exploitation in the next 30 days. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key.
CVE-2020-27694, published 2020-11-09. High severity, CVSS 8.8. EPSS: 7.4% chance of exploitation in the next 30 days. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack.
CVE-2020-27017, published 2020-11-09. Medium severity, CVSS 4.9. EPSS: 6.5% chance of exploitation in the next 30 days. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read…
CVE-2017-7896, published 2017-04-18. Medium severity, CVSS 6.1. EPSS: 4.3% chance of exploitation in the next 30 days. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.
CVE-2020-27018, published 2020-11-09. Medium severity, CVSS 5.5. EPSS: 3.5% chance of exploitation in the next 30 days. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's…
CVE-2014-3922, published 2014-05-30. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the…

Latest

CVE-2021-25252, published 2021-03-03. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by…
CVE-2020-27693, published 2020-11-09. Medium severity, CVSS 4.4. EPSS: 1.8% chance of exploitation in the next 30 days. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.
CVE-2020-27016, published 2020-11-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by…