CVE-2017-9037

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) S44, (2) S5, (3) S_action_fail, (4) S_ptn_update, (5) T113, (6) T114, (7) T115, (8) T117117, (9) T118, (10) T_action_fail, (11) T_ptn_update, (12) textarea, (13) textfield5, or (14) tmLastConfigFileModifiedDate parameter to notification.cgi.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/May/91Exploit, Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1038548Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1117411Patch, Vendor Advisory
https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilitiesExploit, Technical Description, Third Party Advisory
http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/May/91Exploit, Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1038548Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1117411Patch, Vendor Advisory
https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilitiesExploit, Technical Description, Third Party Advisory

Timeline

Published: May 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-90385.5GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF CVE-2017-90395.5GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers CVE-2017-90405.5GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to th CVE-2017-90415.5GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF CVE-2017-90427.8readelf.c in GNU Binutils 2017-04-12 has a "cannot be represented in type long" issue, which might allow remote attackers to cause a denial CVE-2017-90437.8readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to ca CVE-2017-90445.5The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (CVE-2017-90455.9The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, whic CVE-2017-90467.3winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. F CVE-2017-90477.5A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to re CVE-2017-90487.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is sup CVE-2017-90497.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vul