CVE-2016-1224

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting (XSS) attacks via unspecified vectors.

Score

CVSS 3.1 6.1 Medium

Status

Modified - vultures@jpcert.or.jp

Published

2016-06-19

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Worry-free Business Security (Trendmicro)
• Worry-free Business Security Services (Trendmicro)

References

• http://esupport.trendmicro.com/solution/ja-JP/1114102.aspx
• http://jvn.jp/en/jp/JVN48847535/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000089