Priority CRITICAL 100KEV
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19481 · Published 2022-03-29 · No fix listed CWE-345
Priority MEDIUM 55
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03574 · Published 2026-01-08 · Fixed in Build 7190 CWE-120
Priority MEDIUM 53
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02057 · Published 2025-06-17 · Fixed in 8.0.7007 CWE-477
Priority MEDIUM 52
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01415 · Published 2025-06-17 · Fixed in 8.0.7007 CWE-477
Priority MEDIUM 47
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01949 · Published 2025-06-17 · Fixed in 8.0.6955 CWE-74
Priority MEDIUM 47
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01846 · Published 2025-06-17 · Fixed in 8.0.6955 CWE-475
Priority MEDIUM 47
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04138 · Published 2024-01-23 · Fixed in 8.0.0.6570 CWE-434
Priority MEDIUM 45
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02425 · Published 2023-06-26 · Fixed in 8.0.0.6394 CWE-89
Priority MEDIUM 44
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02161 · Published 2023-06-26 · Fixed in 8.0.0.6394 CWE-89
Priority MEDIUM 42
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01576 · Published 2026-01-08 · Fixed in Build 7190 CWE-120
Priority MEDIUM 42
A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01576 · Published 2026-01-08 · Fixed in Build 7190 CWE-120
Priority MEDIUM 42
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.04536 · Published 2024-01-23 · Fixed in 8.0.0.6570 CWE-98
Priority LOW 34
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02454 · Published 2024-01-23 · Fixed in 8.0.0.6570 CWE-79
Priority LOW 33
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00307 · Published 2025-06-17 · Fixed in 8.0.6955 CWE-475
Priority LOW 33
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00299 · Published 2025-06-17 · Fixed in 8.0.6955 CWE-918
Priority LOW 33
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected install…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00363 · Published 2025-06-17 · Fixed in 8.0.6955 CWE-918
Priority LOW 33
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected install…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00363 · Published 2025-06-17 · Fixed in 8.0.6955 CWE-918
Priority LOW 32
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00553 · Published 2024-01-23 · Fixed in 8.0.0.6570 CWE-918
Priority LOW 32
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02454 · Published 2024-01-23 · Fixed in 8.0.0.6570 CWE-79
Priority LOW 32
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02454 · Published 2024-01-23 · Fixed in 8.0.0.6570 CWE-79
Priority LOW 31
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01857 · Published 2023-06-26 · Fixed in 8.0.0.6394 CWE-79
Priority LOW 31
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01857 · Published 2023-06-26 · Fixed in 8.0.0.6394 CWE-79
Priority LOW 31
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01857 · Published 2023-06-26 · Fixed in 8.0.0.6394 CWE-79
Priority LOW 31
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01857 · Published 2023-06-26 · Fixed in 8.0.0.6394 CWE-79
Priority LOW 29
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00936 · Published 2024-01-23 · Fixed in 8.0.0.6570 CWE-79
Load more