Trend Micro Threat Discovery Appliance vulnerabilities

Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.

In Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, the log_query_system.cgi script allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.

In log_query.cgi of Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, remote authenticated users can execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.

The log_query_dlp.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.

The log_query_dae.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.

The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.

The vulnerability in dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to specified locations.

In Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, remote authenticated users can execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.

The admin_sys_time.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.

Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier uses predictable session values, allowing remote attackers to bypass authentication by guessing the value.

The Trend Micro Threat Discovery Appliance 2.6.1062r1 has a directory traversal vulnerability that allows a remote, unauthenticated attacker to delete arbitrary files as root by processing a session_id cookie. This can be exploited to bypass authentication or cause a DoS.

A command execution flaw exists in the Trend Micro Threat Discovery Appliance 2.6.1062r1 with the timezone parameter in the admin_sys_time.cgi interface.