Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security
CVE-2021-36741
Trend Micro Multiple Products Improper Input Validation Vulnerability
Nedir
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
CISA: Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 17 Kasım 2021
Trend Micro için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 3 Kas 2021 | Multiple Products Improper Input Validation | Apex One, Apex One as a Service, and Worry-Free Business Security | Yüksek 7,8 | 1,5% |
| 21 May 2026 | (On-Premise) Directory Traversal | Apex One | Orta 6,7 | 13% |
| 18 Ağu 2025 | OS Command Injection | Apex One | Kritik 9,4 | 25% |
| 21 Eyl 2023 | Remote Code Execution | Apex One and Worry-Free Business Security | Yüksek 7,2 | 4,2% |
| 15 Eyl 2022 | Improper Validation | Apex One and Apex One as a Service | Yüksek 7,2 | 3,4% |
| 31 Mar 2022 | Arbitrary File Upload | Apex Central | Kritik 9,8 | 19% |
| 3 Kas 2021 | Remote Code Execution | Apex One and OfficeScan | Yüksek 8,8 | 11% |
| 3 Kas 2021 | Multiple Products Content Validation Escape | Apex One, OfficeScan and Worry-Free Business Security Agents | Yüksek 8,8 | 6,2% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.