CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-18894
https://notcve.org/view.php?id=CVE-2019-18894
13 Jan 2020 — In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently logged in user. This allows for example attackers who compromised a browser extension to escape from the browser sandbox. En Avast Premium Security versión 19.8.2393, los atacantes pueden enviar una petición especi... • https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2019-18893
https://notcve.org/view.php?id=CVE-2019-18893
13 Jan 2020 — XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways. Una vulnerabilidad de tipo XSS en el componente V... • https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 1CVE-2019-18653
https://notcve.org/view.php?id=CVE-2019-18653
01 Nov 2019 — A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. Se presenta un problema de tipo Cross Site Scripting (XSS) en Avast AntiVirus (Free, Internet Security y Premiere Edition) versión 19.3.2369 build 19.3.4241.440, en la ventana emergente de notificación de red, permitiendo a un atacante ejecutar código JavaScript por medio... • http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-17093
https://notcve.org/view.php?id=CVE-2019-17093
23 Oct 2019 — An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process (PPL) and might bypass some of the self-defense mechanisms. This affects all components that use WMI, e.g., AVGSvc.exe 19.6.4546.0 and TuneupSmartScan.dll 19.1.884.0. Se detectó un problema en Avast antivirus versiones anteriores a 19.8 y AVG antivirus versiones anteriores a 19.8. Una ... • https://safebreach.com/Post/Avast-Antivirus-AVG-Antivirus-DLL-Preloading-into-PPL-and-Potential-Abuses • CWE-427: Uncontrolled Search Path Element •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-11230
https://notcve.org/view.php?id=CVE-2019-11230
18 Jul 2019 — In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink. The next time the product attempts to write to the log file, the target of the symlink is renamed. This defect can be exploited to rename a critical product file (e.g., AvastSvc.exe), causing the product to fail to start on the next system restart. En Avast Antivirus antes de 19.4, un administrador local puede engañar al producto para que cambie el n... • http://www.mcerlane.co.uk/CVE-2019-11230 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-12572 – Avast Anti-Virus Local Credential Disclosure
https://notcve.org/view.php?id=CVE-2018-12572
10 Feb 2019 — Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data. Avast Free Antivirus, en versiones anteriores a la 19.1.2360, almacena credenciales de usuario en la memoria al iniciar sesión, lo que permite que los usuarios locales obtengan información sensible volcando la memoria de la aplicación AvastUI.exe y analizando los datos. Avast Anti-Virus versions prior to... • https://packetstorm.news/files/id/151590 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2017-8307
https://notcve.org/view.php?id=CVE-2017-8307
27 Apr 2017 — In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also exploitable in conjunction with CVE-2017-8308 when Avast Self-Defense is enabled. The vulnerability allows for Denial of Service attacks and hiding traces of a possible attack. En Avast Antivirus versiones anteriores ... • http://www.securityfocus.com/bid/98086 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-8308
https://notcve.org/view.php?id=CVE-2017-8308
27 Apr 2017 — In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components. En Avast Antivirus anteriores a v17, un usuario no privilegiado puede marcar un proceso arbitrario como Trusted desde la perspectiva del producto Avast. Esto evita la característica de Self-Defense del producto, abriendo una pue... • http://www.securityfocus.com/bid/98084 • CWE-269: Improper Privilege Management •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5567
https://notcve.org/view.php?id=CVE-2017-5567
21 Mar 2017 — Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), and Free Antivirus 12.3 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avast process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider... • http://cybellum.com/doubleagent-taking-full-control-antivirus • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.5EPSS: 0%CPEs: 42EXPL: 0CVE-2016-4025 – Avast! Sandbox Escape
https://notcve.org/view.php?id=CVE-2016-4025
19 Apr 2016 — Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call. Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security ... • https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025 • CWE-254: 7PK - Security Features •