CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28648 – Trend Micro Antivirus for Mac Improper Access Control Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-28648
Trend Micro Antivirus for Mac 2020 v10.5 and 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker to establish a connection that could lead to full local privilege escalation within the application. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Trend Micro Antivirus para Mac 2020 versiones v10.5 y 2021 v11 (Consumidor) es susceptible a una vulnerabilidad de escalada de privilegios de control de acceso inapropiado que podría permitir a un atacante establecer una conexión que podría conllevar a una escalada de privilegios local completa dentro de la aplicación. Tome en cuenta que un atacante primero debe obtener la capacidad de ejecutar código poco privilegiado en el sistema objetivo para explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within com.trendmicro.AFM.HelperTool. • https://helpcenter.trendmicro.com/en-us/article/TMKA-10293 https://www.zerodayinitiative.com/advisories/ZDI-21-420 •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25227 – Trend Micro Antivirus for Mac Memory Exhaustion Denial-Of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-25227
Trend Micro Antivirus for Mac 2021 (Consumer) is vulnerable to a memory exhaustion vulnerability that could lead to disabling all the scanning functionality within the application. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability - i.e. the attacker must already have access to the target system (either legitimately or via another exploit). Trend Micro Antivirus para Mac 2021 (Consumer) es susceptible a una vulnerabilidad de agotamiento de la memoria que podría conllevar a deshabilitar todas las funciones de escaneo dentro de la aplicación. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar código poco privilegiado en el sistema objetivo a los fines de explotar esta vulnerabilidad, es decir, el atacante ya debe tener acceso al sistema objetivo (ya sea legítimamente o mediante otro explotación) This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Trend Micro Antivirus for Mac. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the iCoreService executable. • https://helpcenter.trendmicro.com/en-us/article/TMKA-10191 https://www.zerodayinitiative.com/advisories/ZDI-21-102 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-10868
https://notcve.org/view.php?id=CVE-2020-10868
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to launch the Repair App RPC call from a Low Integrity process. Se detectó un problema en Avast Antivirus versiones anteriores a 20. El endpoint de aswTask RPC para la biblioteca TaskEx en el Avast Service (AvastSvc.exe) permite a atacantes iniciar la llamada Repair App RPC desde un proceso Low Integrity. • https://forum.avast.com/index.php?topic=232420.0 https://forum.avast.com/index.php?topic=232423.0 https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-10867
https://notcve.org/view.php?id=CVE-2020-10867
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass intended access restrictions on tasks from an untrusted process, when Self Defense is enabled. Se detectó un problema en Avast Antivirus versiones anteriores a 20. El endpoint de aswTask RPC para la biblioteca TaskEx en el Avast Service (AvastSvc.exe) permite a atacantes omitir las restricciones de acceso previstas en tareas a partir de un proceso no confiable, cuando Self Defense está habilitado. • https://forum.avast.com/index.php?topic=232420.0 https://forum.avast.com/index.php?topic=232423.0 https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-10866
https://notcve.org/view.php?id=CVE-2020-10866
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to enumerate the network interfaces and access points from a Low Integrity process via RPC. Se detectó un problema en Avast Antivirus versiones anteriores a 20. El endpoint de aswTask RPC para la biblioteca TaskEx en el Avast Service (AvastSvc.exe) permite a atacantes enumerar las interfaces de red y los puntos de acceso a partir de un proceso Low Integrity por medio de una RPC. • https://forum.avast.com/index.php?topic=232420.0 https://forum.avast.com/index.php?topic=232423.0 https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md • CWE-326: Inadequate Encryption Strength •