Trellix Enterprise Security Manager (ESM) vulnerabilities

2 known vulnerabilities in Trellix Enterprise Security Manager (ESM) from Trellix. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Trellix Enterprise Security Manager (ESM): Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-11482Nov 29, 2024TrellixEPSS 2.53%

  A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.

• 8.2 High severity

  Trellix Enterprise Security Manager (ESM): Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-11481Nov 29, 2024Trellix

  A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing interna