CVE-2021-36744

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit the system to escalate privileges and create a denial of service.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Security (Consumer)	2019, 2020, 2021

References

https://helpcenter.trendmicro.com/en-us/article/tmka-10568Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1052/Third Party Advisory, VDB Entry
https://helpcenter.trendmicro.com/en-us/article/tmka-10568Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1052/Third Party Advisory, VDB Entry

Timeline

Published: Sep 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-367459.8A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers CVE-2021-367465.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.CVE-2021-367475.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.CVE-2021-367487.5A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote a CVE-2021-367496.5In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows aut CVE-2021-36757.1Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrit CVE-2021-367508.1ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVau CVE-2021-367514.2ENC DataVault 7.2.3 and before, and OEM versions, use an encryption algorithm that is vulnerable to data manipulation (without knowledge of CVE-2021-367537.8sharkdp BAT before 0.18.2 executes less.exe from the current working directory.CVE-2021-367547.5PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a CVE-2021-367556.1Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.CVE-2021-367566.5CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.