CVSS: 7.0EPSS: %CPEs: 1EXPL: 0CVE-2024-6260 – Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2024-6260
Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Malwarebytes service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://www.malwarebytes.com/secure/cves https://www.zerodayinitiative.com/advisories/ZDI-24-1195 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2016-10717
https://notcve.org/view.php?id=CVE-2016-10717
A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP. Una vulnerabilidad en la implementación de cifrado y permisos de Malwarebytes Anti-Malware, en versiones de consumidor 2.2.1 y anteriores (solucionada en 3.0.4), permite que un atacante asuma el control de la característica de lista blanca (exclusions.dat en %SYSTEMDRIVE%\ProgramData) para permitir la ejecución de aplicaciones no autorizadas, incluyendo malware y sitios web maliciosos. Los archivos que Malwarebytes Malware Protect ha colocado en la lista negra pueden ser ejecutados y, además, los dominios que Malwarebytes Web Protect ha colocado en la lista negra pueden alcanzarse mediante HTTP. • http://www.securitytube.net/video/16690 https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame https://github.com/mspaling/mbam-exclusions-poc- https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt https://www.youtube.com/watch?v=LF5ic5nOoUY • CWE-254: 7PK - Security Features •
CVSS: 9.3EPSS: 2%CPEs: 2EXPL: 3CVE-2014-4936 – Malwarebytes Anti-Malware < 2.0.3 / Anti-Exploit < 1.03.1.1220 - Update Code Execution
https://notcve.org/view.php?id=CVE-2014-4936
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable. La funcionalidad de actualización en el consumidor Malwarebytes Anti-Malware (MBAM) anterior a 2.0.3 y el consumidor Malwarebytes Anti-Exploit (MBAE) 1.04.1.1012 y anteriores permiten a atacantes man-in-the-middle ejecutar código arbitrario mediante la falsificación del servidor de actualización y la subida de un ejecutable. • https://www.exploit-db.com/exploits/41701 https://github.com/0x3a/CVE-2014-4936 http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html • CWE-345: Insufficient Verification of Data Authenticity •