Researchers Demonstrate How EDR and Antivirus Can Be Weaponized Against Users

High-severity security vulnerabilities have been disclosed in different endpoint detection and response EDR and antivirus AV products that could be exploited to turn them into data wipers. "This wiper runs with the permissions of an unprivileged user yet has the ability to wipe almost any file on...

Security Updates for Windows Defender (October 2022)

The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to 1.1.19700.3. It is, therefore, affected by a privilege escalation vulnerability. An authenticated attacker can exploit this to gain elevated privileges. %NASLMINLEVEL 80900 C...

CVE-2022-37971

CVE-2022-37971 is a Windows Defender elevation-of-privilege vulnerability in the Malware Protection Engine. It allows a local attacker with low privileges and no user interaction to potentially obtain SYSTEM-level privileges on the host. The CVSSv3.1 score is 7.1 (LP: local, IL: high, AI: high). ...

KLA20003 PE vulnerability in Microsoft System Center

An elevation of privilege vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2022-37971 Related products Microsoft-Defender-for-Endpoint-for-Windows CVE list CVE-2022-37971 high KB list Solution Install...