Trend Micro has received reports that Deep Discovery Inspector is vulnerable to the following:

CVE-2015-2872

Deep Discovery Inspector is vulnerable to XSS attacks that could allow an unauthenticated user to execute malicious content.

• On some legacy browsers like IE 7 with a low Security Level, Deep Discovery Inspector is vulnerable to XSS that allows an unauthenticated user to execute malicious content through the index.php.
• The widget implementation is vulnerable to XSS that allows an unauthenticated user to execute malicious content.

CVE-2015-2873

Certain Deep Discovery Inspector URLs including the system log and whitelist/blacklist are accessible to a non-administrator user because the pages do not properly check for authorization. An unauthenticated user without administrator privileges may thus gain access to and modify certain system configuration settings.