Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions

Exploit Title: Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions Discovery by: hyp3rlinx Date: 2019-12-02 Vendor Homepage: www.maxpcsecure.com Tested Version: 19.0.4.020 CVE: N/A + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

PT-2019-15829

Name of the Vulnerable Software and Affected Versions Max Secure Anti Virus Plus version 19.0.4.020 Description The issue concerns insecure permissions on the installation directory of the software. This allows local attackers to replace .exe or .dll files, potentially leading to privilege...

Max Secure Anti Virus Plus 19.0.4.020 Insecure Permissions

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAX-SECURE-PLUS-ANTIVIRUS-INSECURE-PERMISSIONS.txt + ISR: ApparitionSec Vendorwww.maxpcsecure.com Affected Product Code Base Max Secure Anti Virus Plus - 19.0.4.020 File hash:...

CVE-2019-15443

The Samsung J7 Max Android device with a build fingerprint of samsung/j7maxlteins/j7maxlte:8.1.0/M1AJQ/G615FXXU2BSB1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other pre-installed...

CVE-2019-15404

The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WWPhone/ASUSX00HD4:7.1.1/NMF26F/14.2016.1712.367-20171225:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-15403

The Asus ZenFone 3s Max Android device with a build fingerprint of asus/INX00G/ASUSX00G1:7.0/NRD90M/INX00G-14.02.1807.33-20180706:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-15397

The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WWPhone/ASUSX00HD4:7.1.1/NMF26F/14.2016.1803.373-20180308:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

Command injection

The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WWPhone/ASUSX00HD4:7.1.1/NMF26F/14.2016.1803.373-20180308:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

Code injection

The Samsung J7 Max Android device with a build fingerprint of samsung/j7maxlteins/j7maxlte:8.1.0/M1AJQ/G615FXXU2BSB1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other pre-installed...

Command injection

The Asus ZenFone 3s Max Android device with a build fingerprint of asus/INX00G/ASUSX00G1:7.0/NRD90M/INX00G-14.02.1807.33-20180706:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

Command injection

The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WWPhone/ASUSX00HD4:7.1.1/NMF26F/14.2016.1712.367-20171225:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-15443

The CVE-2019-15443 entry concerns Samsung J7 Max running Android 8.1.0 with a pre-installed app (com.samsung.android.themecenter, v7.0.1.0) that can enable other pre-installed apps to perform app installations via an accessible component. The underlying issue is that exported capabilities from th...

CVE-2019-15443

The Samsung J7 Max Android device with a build fingerprint of samsung/j7maxlteins/j7maxlte:8.1.0/M1AJQ/G615FXXU2BSB1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other pre-installed...

CVE-2019-15404

The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WWPhone/ASUSX00HD4:7.1.1/NMF26F/14.2016.1712.367-20171225:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-15404

Technical details (affected products, component, root cause, fixes) are not publicly provided in the connected documents. The CVE entry lacks concrete details in the supplied materials. Monitor for updates from vendor and CVE repositories.

CVE-2019-15403

The Asus ZenFone 3s Max Android device with a build fingerprint of asus/INX00G/ASUSX00G1:7.0/NRD90M/INX00G-14.02.1807.33-20180706:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-15397

The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WWPhone/ASUSX00HD4:7.1.1/NMF26F/14.2016.1803.373-20180308:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-15397

The CVE-2019-15397 issue affects the Asus ZenFone Max 4 running Android (build asus/WW_Phone/ASUS_X00HD_4:7.1.1/NMF26F/14.2016.1803.373-20180308:user/release-keys). A pre-installed component in package com.asus.loguploaderproxy (versionCode 1570000020, versionName 7.0.0.4_170901) allows other pre...

CVE-2019-15395

CVE-2019-15395 affects Asus ZenFone 3s Max. A pre-installed app (com.asus.loguploaderproxy, v7.0.0.3_161222) exposes capabilities that allow other pre-installed apps to perform command execution via an accessible component. The issue arises because signatureOrSystem-permissioned apps can exploit ...

CVE-2019-15395

The Asus ZenFone 3s Max Android device with a build fingerprint of asus/INX00G/ASUSX00G1:7.0/NRD90M/INX00G-14.02.1807.33-20180706:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000015, versionName=7.0.0.3161222 that allows other...