Trend Micro Smart Protection Server vulnerabilities

13 CVEs affecting Trend Micro Smart Protection Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-6237, published 2018-05-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-6267, published 2017-01-30. High severity, CVSS 8.8. EPSS: 54.9% chance of exploitation in the next 30 days. SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell…
CVE-2017-14094, published 2018-01-19. Critical severity, CVSS 9.8. EPSS: 19.4% chance of exploitation in the next 30 days. A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cron job injection on a vulnerable system.
CVE-2018-10350, published 2018-05-25. High severity, CVSS 8.8. EPSS: 14.2% chance of exploitation in the next 30 days. A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to…
CVE-2017-11395, published 2017-09-22. High severity, CVSS 8.8. EPSS: 14.1% chance of exploitation in the next 30 days. Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on…
CVE-2017-14097, published 2018-01-19. Critical severity, CVSS 9.8. EPSS: 12.7% chance of exploitation in the next 30 days. An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to decrypt contents of a database with information that…
CVE-2017-14095, published 2018-01-19. High severity, CVSS 8.1. EPSS: 12.5% chance of exploitation in the next 30 days. A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable…
CVE-2017-11398, published 2018-01-19. High severity, CVSS 8.8. EPSS: 8.2% chance of exploitation in the next 30 days. A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions…
CVE-2016-6266, published 2017-01-30. High severity, CVSS 8.8. EPSS: 8.2% chance of exploitation in the next 30 days. ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via…
CVE-2018-6231, published 2018-03-15. Critical severity, CVSS 9.8. EPSS: 6.9% chance of exploitation in the next 30 days. A server auth command injection authentication bypass vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.3 and below could allow remote attackers to escalate privileges on…
CVE-2018-6237, published 2018-05-25. High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days. A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the product to send a large number of specially crafted HTTP…

Latest

CVE-2017-14096, published 2018-01-19. Medium severity, CVSS 6.1. EPSS: 3% chance of exploitation in the next 30 days. A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to execute a malicious payload on vulnerable…
CVE-2016-6269, published 2017-01-30. Critical severity, CVSS 9.1. EPSS: 3.7% chance of exploitation in the next 30 days. Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow remote attackers to read and delete…