CVE-2016-1224

Опубликовано: 19 июн. 2016

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting (XSS) attacks via unspecified vectors.

Ссылки

http://esupport.trendmicro.com/solution/ja-JP/1114102.aspx
Vendor Advisory
http://jvn.jp/en/jp/JVN48847535/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000089
Third Party Advisory
VDB Entry
Vendor Advisory
http://esupport.trendmicro.com/solution/ja-JP/1114102.aspx
Vendor Advisory
http://jvn.jp/en/jp/JVN48847535/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000089
Third Party Advisory
VDB Entry
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:trendmicro:worry-free_business_security:9.0:*:*:*:*:*:*:*

cpe:2.3:a:trendmicro:worry-free_business_security_services:5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 64%

0.00483

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-2222-pjpq-3rhj