CVE-2017-9811: Improper Input Validation

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. By abusing the quarantine read and write operations, it is possible to elevate the privileges to root...

CVE-2017-9812: Exposure of Sensitive Information to an Unauthorized Actor

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312 to read arbitrary files with kluser privileges...

CVE-2017-9810: Cross-Site Request Forgery (CSRF)

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

CVE-2017-9813: Improper Neutralization of Input During Web Page Generation

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312, the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting XSS...

PT-2017-2844

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue exists due to insufficient input validation during quarantine read and write operations in the kav4fs-control service. This can be exploited by a remo...

PT-2017-2932

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the reportId parameter of the getReportStatus action method in the web interface, which can be exploited to read arbitrary files with...

PT-2017-2933

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the absence of Anti-CSRF tokens in all forms on the web interface of Kaspersky Anti-Virus for Linux File Server. This could allow a remo...

PT-2017-2895

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue concerns a cross-site scripting XSS vulnerability related to the scriptName parameter of the licenseKeyInfo action method. This vulnerability can be...

CVE-2014-2385: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the 1 newListList:ExcludeFileOnExpression, 2 newListList:ExcludeFilesystems, or 3 newListList:ExcludeMountPaths parameter to...

PT-2014-4671

Name of the Vulnerable Software and Affected Versions Sophos Anti-Virus for Linux versions prior to 9.6.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the web UI. These vulnerabilities allow local users to inject arbitrary web script or HTML via specific...

CVE-2008-6662: Improper Input Validation

AVG Anti-Virus for Linux 7.5.51, and possibly earlier, allows remote attackers to cause a denial of service segmentation fault or possibly execute arbitrary code via a malformed UPX compressed file, which triggers memory corruption...

CVE-2006-6408: Undefined Security Weakness

Kaspersky Anti-Virus for Linux Mail Servers 5.5.10 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...

CVE-2006-6409: Undefined Security Weakness

F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service possibly fatal scan error, and possibly bypass virus detection, by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...

CVE-2006-5645: Undefined Security Weakness

Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11, when "Enabled scanning of archives" is set, allows remote attackers to cause a denial of service infinite loop via a malformed RAR archive with an Archive Header section with...

CVE-2006-5647: Improper Restriction of Operations within the Bounds of a Memory Buffer

Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11 allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a malformed CHM file with a large name length in the CHM chunk...

CVE-2005-3664: Undefined Security Weakness

Heap-based buffer overflow in Kaspersky Anti-Virus Engine, as used in Kaspersky Personal 5.0.227, Anti-Virus On-Demand Scanner for Linux 5.0.5, and F-Secure Anti-Virus for Linux 4.50 allows remote attackers to execute arbitrary code via a crafted CHM file...