CVE-2019-19696

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishing sites.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Password Manager	5.0.0.1076 and below (Windows) and 5.0.1047 and below (Mac)

References

https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124092.aspxVendor Advisory
https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1124091.aspxVendor Advisory
https://jvn.jp/en/jp/JVN37183636/index.htmlThird Party Advisory
https://jvn.jp/jp/JVN37183636/index.htmlThird Party Advisory
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124092.aspxVendor Advisory
https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1124091.aspxVendor Advisory
https://jvn.jp/en/jp/JVN37183636/index.htmlThird Party Advisory
https://jvn.jp/jp/JVN37183636/index.htmlThird Party Advisory

Timeline

Published: Jan 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-196976.7An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an att CVE-2019-196986.5marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.CVE-2019-196997.2There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, lead CVE-2019-19707.5A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol inspection engine of Cisco Firepower Threat Defens CVE-2019-197027.5The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote CVE-2019-197036.1In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.CVE-2019-197047.5In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.CVE-2019-197057.8Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG b CVE-2019-197077.5On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint d CVE-2019-197086.1The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attri CVE-2019-197096.1MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishi CVE-2019-19719.8A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to