341 matches found
PT-2021-3925
Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description Remote code execution is possible in MSHTML, the browser rendering engine used by Microsoft Internet Explorer and hosted within Microsoft Office documents. The issue stems from...
Backstab - A Tool To Kill Antimalware Protected Processes
Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer ProcExp driver, which...
CVE-2021-31728
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to .\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook...
CVE-2021-31728
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to .\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook...
Design/Logic Flaw
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to .\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook...
Design/Logic Flaw
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to .\ZemanaAntiMalware, register with the driver using IOCTL...
CVE-2021-31728
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to .\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook...
CVE-2021-31727
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to .\ZemanaAntiMalware, register with the driver using IOCTL...
CVE-2021-31728
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to .\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook...
CVE-2021-31728
CVE-2021-31728 affects MalwareFox AntiMalware 2.74.0.150, with vulnerable drivers zam64.sys and zam32.sys. A non-privileged process can obtain a handle to \.\ZemanaAntiMalware, register via IOCTL 0x80002010, allocate executable memory via IOCTL 0x80002040, install a hook with IOCTL 0x80002044, an...
CVE-2021-31727
MalwareFox AntiMalware 2.74.0.150 is affected by CVEs CVE-2021-31727 and CVE-2021-31728. The vulnerability stems from incorrect access control in zam64.sys and zam32.sys, enabling a non-privileged process to obtain a handle to \.\ZemanaAntiMalware and issue IOCTLs (notably 0x80002010, 0x80002014,...
Persistence – AMSI
AMSI Antimalware Scan Interface is a vendor agnostic interface which can communicate with the endpoint in order to prevent execution of malware. The scan performed… Continue reading - Persistence - AMSI...
MalwareFox Anti-Malware 安全漏洞
MalwareFox Anti-Malware is an application from the American company MalwareFox. A malicious code detection software. A security vulnerability exists in MalwareFox AntiMalware 2.74.0.150, which allows the execution of ring 0 code to be exposed in the context of a driver, allowing an unprivileged...
PT-2021-7812 · Malwarefox · Malwarefox Antimalware
Name of the Vulnerable Software and Affected Versions: MalwareFox AntiMalware versions 2.74.0.150 Description: The issue is related to insufficient access control in the zam64.sys and zam32.sys drivers of MalwareFox AntiMalware, allowing a non-privileged process to elevate its privileges. This ca...
Exploit for CVE-2021-31728
CVE-2021-31727 and CVE-2021-31728 Public Reference f...
The vulnerability in the driver for the Early Launch Antimalware (ELAM) security technology of Microsoft Windows allows a malicious actor to bypass security functions.
The vulnerability of the driver for the Early Launch Antimalware ELAM security technology for Microsoft Windows is related to security configuration errors. Exploiting this vulnerability can allow attackers to bypass security functions...
The vulnerability in the driver for the Early Launch Antimalware (ELAM) security technology of Microsoft Windows allows a malicious actor to bypass security functions.
The vulnerability of the driver for the Early Launch Antimalware ELAM security technology for Microsoft Windows relates to the disclosure of information. Exploiting this vulnerability could allow a hacker to bypass security functions...
CVE-2021-28447
Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability...