CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36200
https://notcve.org/view.php?id=CVE-2020-36200
21 Jan 2021 — TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs. TinyCheck anterior a los commits 9fd360d y ea53de8, permitió a un atacante autenticado enviar una petición GET HTTP hacia una URL diseñada • https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-gqpw-3669-6w5h • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 0CVE-2020-36199
https://notcve.org/view.php?id=CVE-2020-36199
21 Jan 2021 — TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places. TinyCheck anterior a los commits 9fd360d y ea53de8, era vulnerable a una inyección de comandos debido a comprobaciones insuficientes de los parámetros de entrada en varios lugares • https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-j2vj-mhr6-795m • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35929
https://notcve.org/view.php?id=CVE-2020-35929
19 Jan 2021 — In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data. En TinyCheck anterior a los commits 9fd360d y ea53de8, el script de instalación de la herramienta contenía credenciales embebidas para la parte del backend de la herramienta. Esta información podría ser usada por un atacante para el acceso no autorizado a datos remotos • https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-9f7g-72h2-59g7 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-28950
https://notcve.org/view.php?id=CVE-2020-28950
04 Dec 2020 — The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process. El instalador de Kaspersky Anti-Ransomware Tool (KART) anterior a KART versión 4.0 Parche C era vulnerable a un ataque de secuestro de DLL que permitía a un atacante elevar los privilegios durante el proceso de instalación • https://exchange.xforce.ibmcloud.com/vulnerabilities/192653 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25044
https://notcve.org/view.php?id=CVE-2020-25044
02 Sep 2020 — Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to eliminate content of any file in the system. Kaspersky Virus Removal Tool (KVRT) versiones anteriores a 15.0.23.0, era vulnerable a una corrupción de archivos arbitraria que podría proporcionar a un atacante la oportunidad de eliminar el contenido de cualquier archivo en el sistema • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720 •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25043
https://notcve.org/view.php?id=CVE-2020-25043
02 Sep 2020 — The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system. El instalador de Kaspersky VPN Secure Connection versiones anteriores a 5.0, era vulnerable a una eliminación arbitraria de archivos que podría permitir a un atacante eliminar cualquier archivo del sistema • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25045
https://notcve.org/view.php?id=CVE-2020-25045
02 Sep 2020 — Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system. Los instaladores de Kaspersky Security Center y Kaspersky Security Center Web Console versiones anteriores a 12 y anteriores a 12 Parche A, eran vulnerables a un ataque de secuestro de DLL que permitía a un atacante elevar los privilegios en el sistema • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720 • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.7EPSS: 0%CPEs: 15EXPL: 1CVE-2019-15689
https://notcve.org/view.php?id=CVE-2019-15689
02 Dec 2019 — Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to execute arbitrary code via execution compromised file placed by an attacker with administrator rights. No privilege escalation. Possible whitelisting bypass some of the security products Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud versiones anteriores a 2020 parche E, pr... • https://safebreach.com/Post/Kaspersky-Secure-Connection-DLL-Preloading-and-Potential-Abuses-CVE-2019-15689 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15687
https://notcve.org/view.php?id=CVE-2019-15687
26 Nov 2019 — Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component was vulnerable to remote disclosure of various information about the user's system (like Windows version and version of the product, host unique ID). Information Disclosure. Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security... • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1 •
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15686
https://notcve.org/view.php?id=CVE-2019-15686
26 Nov 2019 — Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable various anti-virus protection features. DoS, Bypass. Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud hasta el 2020, el componente web protection permitió a un... • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1 •