control manager vulnerabilities and fixes

Recent CVEs affecting control manager, with upgrade or downgrade steps. 24 tracked.

Also searched as: controlmanager.

control manager has 24 tracked vulnerabilities, 9 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-03-03. Highest priority: CVE-2017-11389 (score 64/100).

• CVE-2021-25252 MEDIUM 5.5 DOWNGRADE DOWNGRADE Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhau
• CVE-2019-7003 CRITICAL 10.0 UPGRADE A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticat
• CVE-2019-14688 HIGH 7.0 DOWNGRADE DOWNGRADE Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of
• CVE-2018-3607 HIGH 8.8 DOWNGRADE XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.
• CVE-2018-3606 HIGH 8.8 DOWNGRADE XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulne
• CVE-2018-3605 HIGH 8.8 DOWNGRADE TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Tren
• CVE-2018-3604 HIGH 8.8 DOWNGRADE GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 cou
• CVE-2018-3603 HIGH 8.8 DOWNGRADE A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could
• CVE-2018-3602 HIGH 8.8 DOWNGRADE An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager
• CVE-2018-3601 CRITICAL 9.8 DOWNGRADE A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a rem
• CVE-2018-3600 MEDIUM 6.5 DOWNGRADE A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 cou
• CVE-2018-10512 HIGH 7.5 DOWNGRADE A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a
• CVE-2018-10511 CRITICAL 10.0 DOWNGRADE A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a ser
• CVE-2018-10510 CRITICAL 9.8 DOWNGRADE A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0
• CVE-2017-11390 HIGH 7.5 DOWNGRADE XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lea
• CVE-2017-11389 CRITICAL 9.8 DOWNGRADE Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers
• CVE-2017-11388 HIGH 8.8 DOWNGRADE SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.d
• CVE-2017-11387 HIGH 7.5 DOWNGRADE Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication val
• CVE-2017-11386 CRITICAL 9.8 DOWNGRADE SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due
• CVE-2017-11385 CRITICAL 9.8 DOWNGRADE SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due
• CVE-2017-11384 CRITICAL 9.8 DOWNGRADE SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due
• CVE-2017-11383 CRITICAL 9.8 DOWNGRADE SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due
• CVE-2016-6220 HIGH 7.5 DOWNGRADE Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0.
• CVE-2012-2998 HIGH 7.5 UPGRADE SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823

FAQ

How do I fix control manager vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is control manager being exploited right now?

None of the tracked control manager CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which control manager CVE should I patch first?

CVE-2017-11389 currently ranks highest (64/100): Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers.

RSS feed for control manager · ← Back to latest CVEs