CVE-2022-28965

In Avast Premium Security, CVE-2022-28965 refers to DLL hijacking in the components instup.exe and wsc_proxy.exe prior to version 21.11.2500 . The vulnerability allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) by presenting a crafted DLL file, due to loading a DLL w...

CVE-2023-42124

CVE-2023-42124 concerns Avast Premium Security. The flaw is in the sandbox feature’s implementation, caused by incorrect authorization, allowing a local attacker who can run low-privileged code to escalate privileges and execute arbitrary code outside the sandbox, at medium integrity and high imp...

CVE-2021-27241

This CVE-2021-27241 affects Avast Premium Security 20.8.2429 (Build 20.8.5653.561). The flaw exists in the AvastSvc.exe module and is triggered by creating a directory junction, allowing a local attacker to delete arbitrary directories via abusing the service, which can lead to a denial-of-servic...

CVE-2022-28964

CVE-2022-28964 describes an arbitrary file-write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) that can cause a Denial of Service when a crafted DLL is processed. The connected documents consistently state the issue as a local vulnerability affecting Avast Prem...

CVE-2023-42125

This CVE concerns Avast Premium Security. The vulnerability lies in the Sandbox feature implementation: an attacker who can run low-privilege code locally can abuse symbolic links to create arbitrary namespace objects, enabling privilege escalation to SYSTEM and arbitrary code execution. Affected...

CVE-2019-18894

Affected software: Avast Premium Security 19.8.2393. Issue: a flaw in the local web server running by Avast Antivirus on port 27275 that processes a command enables arbitrary OS command execution with the privileges of the currently logged-in user. Impact: could allow an attacker (e.g., via a com...