CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

Design/Logic Flaw

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

Cross site scripting

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges...

CVE-2019-18894

Affected software: Avast Premium Security 19.8.2393. Issue: a flaw in the local web server running by Avast Antivirus on port 27275 that processes a command enables arbitrary OS command execution with the privileges of the currently logged-in user. Impact: could allow an attacker (e.g., via a com...

CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

CVE-2019-18893

CVE-2019-18893 involves an XSS flaw in the Video Downloader component (pre-1.5) of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77. The vulnerability lets an attacker’s website execute code in the context of this component. Although Video Downloader is a browser extension, i...

CVE-2019-18893

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges...

Google & Mozilla ban Avast security extensions over data snooping

By Sudais In this specific case, it was Avast & AVG Security whose two browser extensions each have been found spying on users... This is a post from HackRead.com Read the original post: Google & Mozilla ban Avast security extensions over data snooping...

Avast and AVG Browser Extensions Spying On Chrome and Firefox Users

If your Firefox or Chrome browser has any of the below-listed four extensions offered by Avast and its subsidiary AVG installed, you should disable or remove them as soon as possible. Avast Online Security AVG Online Security Avast SafePrice AVG SafePrice Why? Because these four widely installed...

Avast and AVG Browser Extensions Spying On Chrome and Firefox Users

If your Firefox or Chrome browser has any of the below-listed four extensions offered by Avast and its subsidiary AVG installed, you should disable or remove them as soon as possible. Avast Online Security AVG Online Security Avast SafePrice AVG SafePrice Why? Because these four widely installed...

Avast Antivirus <= 19.3.2369 XSS Vulnerability - Windows

Avast Antivirus is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:avast:antivirus...

AVG AntiVirus Cross-Site Scripting Vulnerability (CNVD-2020-10164)

Avast Antivirus is a suite of antivirus software from the Czech company Avast. A cross-site scripting vulnerability exists in Network Notification Popup in Avast AntiVirus Free, Internet Security and Premiere Edition version 19.3.2369 build 19.3.4241.440. The vulnerability stems from a lack of...

CVE-2019-18653

A Cross Site Scripting XSS issue exists in Avast AntiVirus Free, Internet Security, and Premiere Edition 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

CVE-2019-18653

A Cross Site Scripting XSS issue exists in Avast AntiVirus Free, Internet Security, and Premiere Edition 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

Cross site scripting

A Cross Site Scripting XSS issue exists in Avast AntiVirus Free, Internet Security, and Premiere Edition 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

CVE-2019-18653

A Cross Site Scripting XSS issue exists in Avast AntiVirus Free, Internet Security, and Premiere Edition 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

CVE-2019-18653

CVE-2019-18653 affects Avast Antivirus (Free, Internet Security, and Premiere) version 19.3.2369 build 19.3.4241.440. A Cross‑Site Scripting (XSS) vulnerability exists in the Network Notification Popup that can execute JavaScript via an SSID Name. The Red Hat/CNVD/OpenVAS entries describe the roo...

Avast Antivirus < 19.4 Link Following Vulnerability - Windows

Avast Antivirus is prone to a link following vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:avast:antivirus";...

Avast Free Antivirus < 19.1.2360 Information Disclosure Vulnerability - Windows

Avast Free Antivirus is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

A week in security (October 21 – 27)

Last week on Malwarebytes Labs, we explored a link between Magecart Group 5 and the Carbanak APT, we discussed the growing rate of robocalls threatening user privacy, and we tipped you off on how to protect yourself from doxing. We were glad to see the BBC raise awareness about stalkerware, much...