CVE-2020-9399

The CVE-2020-9399 entry concerns the Avast AV parsing engine where a crafted ZIP archive can bypass virus detection. Affected products are Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux (prior to 12 definitions 200114-0). The description primarily states the bypass vector (crafted ZIP...

A week in security (February 10 – 16)

Last week on Malwarebytes Labs, we explained how to battle online coronavirus scams with facts, discussed the persistent re-infection techniques of Android/Trojan.xHelper and how to remove it, provided cyber tips for safe online dating, and showed how Hollywood teaches us misleading cybersecurity...

Avast acknowledges collecting user data; shuts down Jumpshot

By Waqas The anti-virus firm Avast has announced shutting down one of its subsidiaries called Jumpshot. This is a post from HackRead.com Read the original post: Avast acknowledges collecting user data; shuts down Jumpshot...

New report suggests anti-virus firm Avast is selling user data to 3rd parties

By Sudais Asif It turns out Avast is using your browsing data to make big bucks. Here is what the new documents have revealed... This is a post from HackRead.com Read the original post: New report suggests anti-virus firm Avast is selling user data to 3rd parties...

CVE-2019-17190

A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe which is running as NT AUTHORITY\SYSTEM when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, th...

CVE-2019-17190

A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe which is running as NT AUTHORITY\SYSTEM when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, th...

Privilege escalation

A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe which is running as NT AUTHORITY\SYSTEM when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, th...

CVE-2019-17190

CVE-2019-17190 affects Avast Secure Browser 76.0.1659.101. The issue is an insecure ACL on Update.ini in %PROGRAMDATA%\Avast Software\Browser\Update, altered by AvastBrowserUpdate.exe running as NT AUTHORITY\SYSTEM during update checks. A low-privileged user can create a hard link Update.ini to a...

CVE-2019-17190

A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe which is running as NT AUTHORITY\SYSTEM when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, th...

PT-2020-9879 · Avast · Avast Secure Browser

Name of the Vulnerable Software and Affected Versions: Avast Secure Browser version 76.0.1659.101 Description: A Local Privilege Escalation issue was discovered due to an insecure ACL set by the AvastBrowserUpdate.exe when AvastSecureBrowser.exe checks for new updates. The elevated process cleans...

Avast Premium Security Arbitrary OS Command Execution Vulnerability

Avast Premium Security is a comprehensive security software that prevents viruses, spyware and other malicious threats from infecting your PC. An arbitrary OS command execution vulnerability exists in Avast Premium Security 19.8.2393. An attacker can exploit this vulnerability to execute arbitrar...

CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

CVE-2019-18893

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges...

CVE-2019-18893

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges...

CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

Cross site scripting

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges...

Design/Logic Flaw

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

CVE-2019-18894

Affected software: Avast Premium Security 19.8.2393. Issue: a flaw in the local web server running by Avast Antivirus on port 27275 that processes a command enables arbitrary OS command execution with the privileges of the currently logged-in user. Impact: could allow an attacker (e.g., via a com...

CVE-2019-18893

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges...