Poh Jia Hao

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central modTMCM (affected versions not specified) **Description** The issue is related to uncertain behavior of a function due to a mismatch of parameter values in the modTMCM widget of Trend Micro Apex Central. This can be exploited by a remote attacker to upload arbitrary files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (affected versions not specified) **Description** The issue is related to the getBlock() function in Trend Micro Apex Central's security monitoring and management tool, which fails to neutralize special elements in its output. This can be exploited by a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (affected versions not specified) **Description** The issue concerns a Local File Inclusion Remote Code Execution vulnerability in the Trend Micro Apex Central widget, specifically affecting the getObjWGFServiceApiByApiName function. This vulnerability can potentially be exploited, in combination with others, to achieve remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central (affected versions not specified) Description: The issue is related to insufficient validation of incoming requests in the modTMSM component of Trend Micro Apex Central, a security monitoring and management tool. This can be exploited by a remote attacker to gain unauthorized access to protected information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central (affected versions not specified) Description: The issue is related to insufficient validation of incoming requests in the modOSCE component of Trend Micro Apex Central, a security monitoring and management tool. This can allow a remote attacker to gain unauthorized access to protected information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Mobile Security (Enterprise) (affected versions not specified) **Description** The issue is related to reflected cross-site scripting (XSS) that could allow an exploit against an authenticated victim who visits a malicious link provided by an attacker. This occurs in the DevicesManagementEditNotePopupTip component of Trend Micro Mobile Security for Enterprises. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (affected versions not specified) **Description** An unrestricted file upload vulnerability could allow a remote attacker to create arbitrary files on affected installations. Although authentication is required to exploit this issue, it could be exploited when the attacker has any valid set of credentials. This issue could be potentially used in combination with another vulnerability to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Mobile Security (Enterprise) (affected versions not specified) **Description** The issue is related to reflected cross-site scripting (XSS) vulnerabilities, which could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. This vulnerability enables remote attackers to execute web requests with the victim's privileges on affected installations. User interaction is required for the exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Mobile Security (Enterprise) (affected versions not specified) **Description** The issue is related to reflected cross-site scripting (XSS) vulnerabilities. This could allow an exploit against an authenticated victim who visits a malicious link provided by an attacker. The vulnerability enables remote attackers to execute web requests with the victim's privileges on affected installations. User interaction is required for the exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (on-premise) (affected versions not specified) **Description** The issue concerns certain dashboard widgets in Trend Micro Apex Central that are susceptible to cross-site scripting (XSS) attacks. These attacks may potentially allow an attacker to achieve remote code execution on affected servers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (on-premise) (affected versions not specified) **Description** The issue concerns certain dashboard widgets in Trend Micro Apex Central that are susceptible to cross-site scripting (XSS) attacks. These attacks may potentially allow an attacker to achieve remote code execution on affected servers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (on-premise) (affected versions not specified) **Description** The issue concerns certain dashboard widgets in Trend Micro Apex Central that are susceptible to cross-site scripting (XSS) attacks. These attacks may potentially allow an attacker to achieve remote code execution on affected servers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (affected versions not specified) **Description** A local file inclusion issue in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations. This issue must be used in conjunction with another vulnerability to exploit an affected system. Additionally, an attacker must first obtain a valid set of credentials on the target system in order to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (affected versions not specified) **Description** The issue is related to insufficient validation of incoming requests in the modVulnerabilityProtect module of Trend Micro Apex Central, a security monitoring and management tool. This can allow a remote attacker to disclose protected information. The vulnerability is a post-authenticated server-side request forgery (SSRF) issue, which means an attacker must first obtain the ability to execute low-privileged code on the target system to exploit it. The attacker could then interact with internal or local services directly. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central (affected versions not specified) **Description** The issue exists due to a lack of protection for the web page structure in Trend Micro Apex Central, allowing for cross-site scripting (XSS) attacks. This could enable a remote attacker to conduct an XSS attack, potentially leading to remote code execution on affected servers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP CRM versions <= 17.0.3 **Description** The issue allows an unauthorized authenticated user to read a database table containing customer data due to improper access control. **Recommendations** For versions <= 17.0.3, update to a version higher than 17.0.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP CRM versions <= 18.0.1 **Description** The issue is related to improper input validation, which fails to strip certain PHP code from user-supplied input when creating a Website. This allows an attacker to inject and evaluate arbitrary PHP code. Approximately 13,472 devices are potentially affected, mainly distributed in France, the United States, and other countries. **Recommendations** For Dolibarr ERP CRM versions <= 18.0.1, update to a version higher than 18.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the Website creation feature to minimize the risk of exploitation. Avoid using user-supplied input in the creation of Websites until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenCart versions 4.0.0.0 through 4.0.2.2 **Description** The issue allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server. This is due to a Path Traversal vulnerability. **Recommendations** For OpenCart versions 4.0.0.0 through 4.0.2.2, consider disabling access to the Log component for users with modify privileges until a patch is available. Restrict access to sensitive files on the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central versions prior to build 6481 Trend Micro Apex Central 2019 version <= Build 6394 **Description** The issue is related to insufficient validation of incoming requests in the modDeepSecurity widget of the monitoring panel of Trend Micro Apex Central. This could allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack, enabling interaction with internal or local services directly. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system. **Recommendations** For Trend Micro Apex Central 2019 versions prior to build 6481, update to a version with build 6481 or later to resolve the issue. For Trend Micro Apex Central 2019 version <= Build 6394, update to a version with build higher than 6394 to mitigate the risk. As a temporary workaround, consider restricting access to the modDeepSecurity widget until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex Central versions prior to build 6481 **Description** A server-side request forgery (SSRF) vulnerability could allow an attacker to interact with internal or local services directly. The attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue. The vulnerability is related to insufficient validation of incoming requests, which can be exploited by a remote attacker to perform an SSRF attack. **Recommendations** For versions prior to build 6481, update to a version with build 6481 or later to resolve the issue. As a temporary workaround, consider restricting access to internal or local services to minimize the risk of exploitation.