CVSS: 2.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23349
https://notcve.org/view.php?id=CVE-2023-23349
Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials. Kaspersky solucionó un problema de seguridad en Kaspersky Password Manager (KPM) para Windows que permitía a un usuario local recuperar las credenciales autocompletadas de un volcado de memoria cuando se usaba la extensión KPM para Google Chrome. Para explotar el problema, un atacante debe engañar a un usuario para que visite un formulario de inicio de sesión de un sitio web con las credenciales guardadas, y la extensión KPM debe completar automáticamente estas credenciales. • https://support.kaspersky.com/vulnerability/list-of-advisories/12430#180324 • CWE-316: Cleartext Storage of Sensitive Information in Memory •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-27535
https://notcve.org/view.php?id=CVE-2022-27535
Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker. La versión de Kaspersky VPN Secure Connection para Windows hasta la 21.5 era vulnerable a la eliminación arbitraria de archivos a través del abuso de su función "Eliminar todos los datos e informes de servicio" por parte de un atacante local autenticado • https://forum.kaspersky.com/topic/kaspersky-statement-on-cve-2022-27535-26742 https://support.kaspersky.com/general/vulnerability.aspx?el=12430#050822 https://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-27534
https://notcve.org/view.php?id=CVE-2022-27534
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies). Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases lanzados antes del 12 de marzo de 2022, tenían un error en un módulo de análisis de datos que potencialmente permitía a un atacante ejecutar código arbitrario. La corrección fue realizada de forma automática. • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-27223
https://notcve.org/view.php?id=CVE-2021-27223
A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security. A local user could cause Windows crash by running a specially crafted binary module. The fix was delivered automatically. Credits: (Straghkov Denis, Kurmangaleev Shamil, Fedotov Andrey, Kuts Daniil, Mishechkin Maxim, Akolzin Vitaliy) @ ISPRAS Se presentaba un problema de denegación de servicio en uno de los módulos incorporados en los productos Kaspersky Anti-Virus for home y Kaspersky Endpoint Security. Un usuario local podía causar el bloqueo de Windows al ejecutar un módulo binario especialmente diseñado. • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_1 •
CVSS: 7.8EPSS: 0%CPEs: 19EXPL: 0CVE-2021-35052 – Kaspersky Password Manager Improper Privilege Management Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-35052
A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. Un componente de Kaspersky Password Manager podría permitir a un atacante elevar el nivel de integridad de un proceso de Medio a Alto This vulnerability allows local attackers to escalate privileges on affected installations of Kaspersky Password Manager. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Kaspersky Password Manager Service. The issue results from execution with unnecessary privileges. An attacker can leverage this vulnerability to escalate privileges from medium integrity and execute code in the context of the current user at high integrity. • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 https://www.zerodayinitiative.com/advisories/ZDI-21-1335 • CWE-269: Improper Privilege Management •