AO
Endpoint Security
Apex One
On CISA KEVExploited in the wild
180
CVEs
11
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 120Medium 47Low 0
Watch
Add Apex One to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-42101 | 7.8 | Oct 21 | An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations Affected: 2019; 2019 |
| CVE-2021-42012 | 7.8 | Oct 21 | A stack-based buffer overflow vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate… Affected: 2019; 2019 |
| CVE-2021-42011 | 7.8 | Oct 21 | An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected… Affected: 2019; 2019 |
| CVE-2021-32464 | 7.8 | Aug 4 | An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security Services could allow an… Affected: 2019 |
| CVE-2021-32463 | 7.8 | Jul 20 | An incorrect permission assignment denial-of-service vulnerability in Trend Micro Apex One, Apex One as a Service (SaaS), Worry-Free Business Security 10.0 SP1 and Worry-Free… Affected: 2019 |
| CVE-2021-28645 | 7.8 | Apr 13 | An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on… Affected: 2019; 2019 |
| CVE-2021-25253 | 7.8 | Apr 13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local… Affected: 2019; 2019 |
| CVE-2021-25250 | 7.8 | Apr 13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to… Affected: 2019; 2019 |
| CVE-2021-25249 | 7.8 | Feb 4 | An out-of-bounds write information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1 and Services)… Affected: 2019 |
| CVE-2020-28572 | 7.8 | Nov 18 | A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a… Affected: 2019 |
| CVE-2020-25773 | 7.8 | Sep 29 | A vulnerability in the Trend Micro Apex One ServerMigrationTool component could allow an attacker to execute arbitrary code on affected products Affected: 2019; saas |
| CVE-2020-24563 | 7.8 | Sep 29 | A vulnerability in Trend Micro Apex One may allow a local attacker to manipulate the process of the security agent unload option (if configured), which then could be manipulated… Affected: 2019; saas |
| CVE-2020-24559 | 7.8 | Sep 1 | A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipulate a certain… Affected: 2019; saas |
| CVE-2020-24556 | 7.8 | Sep 1 | A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows may allow an… Affected: 2019; saas |
| CVE-2024-39753 | 7.5 | Oct 22 | An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations Affected: 2019 (14.0) before 14.0.0.12980 |
| CVE-2022-44654 | 7.5 | Dec 12 | Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH memory protection mechanism which helps… Affected: before 14.0.11789; 2019 |
| CVE-2022-40141 | 7.5 | Sep 19 | A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication strings that may contain some… Affected: 2019 |
| CVE-2022-24678 | 7.5 | Feb 24 | An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1… Affected: 2019 |
| CVE-2021-23139 | 7.5 | Oct 21 | A null pointer vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an attacker to crash the CGI program on affected installations Affected: 2019; 2019 |
| CVE-2020-8470 | 7.5 | Mar 18 | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete… Affected: 2019 |
| CVE-2019-18188 | 7.5 | Oct 28 | Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One… Affected: 2019 |
| CVE-2019-9489 | 7.5 | Apr 5 | A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 10.0, 9.5 and 9.0) could allow an… Affected: through b1066 |
| CVE-2022-40143 | 7.3 | Sep 19 | A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure… Affected: 2019 |
| CVE-2022-45797 | 7.1 | Dec 12 | An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to… Affected: 2019 |
| CVE-2021-45442 | 7.1 | Jan 10 | A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to overwrite arbitrary files in the… Affected: 2019; 2019 |
| CVE-2021-44024 | 7.1 | Jan 10 | A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services) could allow a… Affected: 2019; 2019 |
| CVE-2020-24558 | 7.1 | Sep 1 | A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an attacker to manipulate it to cause an… Affected: 2019; saas |
| CVE-2025-71215 | 7.0 | May 21 | A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on… Affected: All versions, or not specified |
| CVE-2024-36304 | 7.0 | Jun 10 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations Affected: 2019 (14.0) before 14.0.0.12980 |
| CVE-2023-32555 | 7.0 | Jun 26 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations Affected: before 14.0.12105; 2019 |
| CVE-2023-32554 | 7.0 | Jun 26 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations Affected: before 14.0.12105; 2019 |
| CVE-2022-44651 | 7.0 | Dec 12 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations Affected: before 14.0.11789; 2019 |
| CVE-2022-41744 | 7.0 | Oct 10 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate privileges and turn a… Affected: 2019 (on-prem) and SaaS |
| CVE-2022-41745 | 7.0 | Oct 10 | An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause memory corruption on a certain service… Affected: 2019 (on-prem) and SaaS |
| CVE-2023-25147 | 6.7 | Mar 10 | An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a… Affected: before 14.0.11960; 2019 |
| CVE-2022-41748 | 6.7 | Oct 10 | A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials to bypass certain… Affected: 2019 (on-prem) and SaaS |
| CVE-2020-8607 | 6.7 | Aug 5 | An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in… Affected: 2019; saas |
| CVE-2021-25246 | 6.5 | Feb 4 | An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an… Affected: 2019 |
| CVE-2023-52330 | 6.1 | Jan 23 | A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central Affected: before 14.0.12849; 2019 |
| CVE-2019-19692 | 6.1 | Dec 20 | Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console Affected: 2019 |
| CVE-2024-36307 | 5.5 | Jun 10 | A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information about the agent on… Affected: 2019 (14.0) before 14.0.0.12980 |
| CVE-2024-36306 | 5.5 | Jun 10 | A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to create a denial-of-service condition on… Affected: 2019 (14.0) before 14.0.0.12980 |
| CVE-2023-32556 | 5.5 | Jun 26 | A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information Affected: before 14.0.12105; 2019 |
| CVE-2023-30902 | 5.5 | Jun 26 | A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privileged Trend Micro… Affected: before 14.0.12105; 2019 |
| CVE-2022-44648 | 5.5 | Dec 12 | An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations Affected: before 14.0.11789; 2019 |
| CVE-2022-44647 | 5.5 | Dec 12 | An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations Affected: before 14.0.11789; 2019 |
| CVE-2022-40140 | 5.5 | Sep 19 | An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affected installations Affected: 2019 |
| CVE-2021-44022 | 5.5 | Dec 3 | A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-service (DoS) Affected: 2019; 2019 |
| CVE-2021-3848 | 5.5 | Oct 6 | An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business… Affected: 2019 |
| CVE-2021-28646 | 5.5 | Apr 13 | An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file… Affected: 2019; 2019 |