Apex One vulnerabilities
98 known vulnerabilities in Apex One from Trend Micro. 97 are rated high or critical, and 11 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.0 High severity
Trend Micro Apex One: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate privileges and turn a specific working directory into a mount point on affected installations. Please n
- 9.8 Critical severity
Trend Micro Apex One: Improper Authentication
A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations.
- 7.3 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbitrary code with elevat
- 7.8 High severity
Trend Micro Apex One: Improper Privilege Management
A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local attacker to create a writable folder in an arbitrary location and escalate privileges on affected instal
- 7.2 High severity
Trend Micro Apex One and Apex One as a Service Improper Validation Exploited
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, whi
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been deployed automatically
- 7.8 High severity
Trend Micro Apex One: Uncontrolled Search Path Element
An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configuration file to load an untrusted library with escalated privileges on affected installations. Please note
- 7.8 High severity
Trend Micro Apex One: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute
- 9.8 Critical severity
Trend Micro Apex Central Arbitrary File Upload Exploited
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local at
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local at
- 7.5 High severity
Trend Micro Apex One: Uncontrolled Resource Consumption
An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow an atta
- 7.8 High severity
Trend Micro Multiple Products Improper Input Validation Exploited
A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obta
- 8.8 High severity
Trend Micro Multiple Products Improper Input Validation Exploited
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must firs
- 7.8 High severity
Trend Micro Multiple Products Improper Access Control Exploited
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege e
- 9.8 Critical severity
Trend Micro Apex One and OfficeScan Authentication Bypass Exploited
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this v
- 8.8 High severity
Trend Micro Multiple Products Content Validation Escape Exploited
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requi
- 8.8 High severity
Trend Micro Apex One and OfficeScan Remote Code Execution Exploited
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.