CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15688
https://notcve.org/view.php?id=CVE-2019-15688
Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass. Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud hasta el 2020, el componente web protection no informó adecuadamente al usuario sobre la amenaza de redireccionar a un sitio no seguro . Omisión. • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2019-8286
https://notcve.org/view.php?id=CVE-2019-8286
Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Product ID by forcing victim to visit a specially crafted webpage (for example, via clicking phishing link). Vulnerability has CVSS v3.0 base score 2.6 La divulgación de información en Kaspersky Anti-Virus, Kaspersky Internet Security, las versiones de Kaspersky Total Security hasta 2019 podrían revelar una identificación de producto única al obligar a la víctima a visitar una página web especialmente diseñada (por ejemplo, haciendo clic en el enlace de phishing). La vulnerabilidad tiene CVSS v3.0 puntuación base 2.6 • http://www.securityfocus.com/bid/109300 https://support.kaspersky.com/general/vulnerability.aspx?el=12430#110719 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 9%CPEs: 1EXPL: 4CVE-2017-9812 – Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2017-9812
The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges. El parámetro reportId del método de la acción getReportStatus puede ser violado en la interfaz web en Kaspersky Anti-Virus para Linux File Server anterior al paquete de mantenimiento 2 corrección crítica 4 (versión 8.0.4.312), para leer archivos arbitrarios con privilegios kluser. Kaspersky Anti-Virus for Linux File Server version 8.0.3.297 suffers from remote code execution, cross site request forgery, cross site scripting, security bypass, information disclosure, and path traversal vulnerabilities. • https://www.exploit-db.com/exploits/42269 http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html http://seclists.org/fulldisclosure/2017/Jun/33 http://www.securityfocus.com/bid/99330 http://www.securitytracker.com/id/1038798 https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 4CVE-2017-9810 – Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2017-9810
There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. No existen tokens Anti-CSRF en ningún formulario en la interfaz web en Kaspersky Anti-Virus para Linux File Server anterior al paquete de mantenimiento 2 corrección crítica 4 (versión 8.0.4.312). Esto permitiría a un atacante enviar peticiones autenticadas cuando un usuario autenticado navega en un dominio controlado por un atacante. Kaspersky Anti-Virus for Linux File Server version 8.0.3.297 suffers from remote code execution, cross site request forgery, cross site scripting, security bypass, information disclosure, and path traversal vulnerabilities. • https://www.exploit-db.com/exploits/42269 http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html http://seclists.org/fulldisclosure/2017/Jun/33 http://www.securityfocus.com/bid/99330 http://www.securitytracker.com/id/1038798 https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 4CVE-2017-9811 – Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2017-9811
The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root. El kluser es capaz de interactuar con el binario kav4fs-control en Kaspersky Anti-Virus para Linux File Server anterior al paquete de mantenimiento 2 corrección crítica 4 (versión 8.0.4.312). Al violar las operaciones de lectura y escritura en cuarentena, es posible elevar los privilegios a root. Kaspersky Anti-Virus for Linux File Server version 8.0.3.297 suffers from remote code execution, cross site request forgery, cross site scripting, security bypass, information disclosure, and path traversal vulnerabilities. • https://www.exploit-db.com/exploits/42269 http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html http://seclists.org/fulldisclosure/2017/Jun/33 http://www.securityfocus.com/bid/99330 http://www.securitytracker.com/id/1038798 https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities • CWE-20: Improper Input Validation •