CVE-2021-26718

CVE-2021-26718 concerns Kaspersky Internet Security (KIS) for macOS where AV bypass could occur via an XPC service. Public details describe an improper client verification in the system extension’s XPC communication (IPCService) that allowed a normal user to interact with the XPC service, inject ...

CVE-2022-27534

CVE-2022-27534 affects Kaspersky Anti-Virus for home and Kaspersky Endpoint Security with antivirus databases released before 12 Mar 2022. A bug in the data parsing module could allow an attacker to execute arbitrary code. Impact is high; CVSSv3.1 base score 9.8 (NETWORK, NONE, UI: NONE, S: UNCHA...

CVE-2021-27223

CVE-2021-27223 affects Kaspersky Anti‑Virus (home) and Kaspersky Endpoint Security. A local user can trigger a denial‑of‑service by executing a specially crafted binary module, causing Windows crash. The fix was delivered automatically by the vendor. The available documents do not provide deeper ...

CVE-2019-8286

CVE-2019-8286 concerns Kaspersky URL Advisor in multiple Kaspersky products. The issue stems from how the URL Advisor injects a remotely-hosted JavaScript into pages, where the injected URL contained a unique, per-user identifier. This could allow websites or third-party services to read the Kasp...

CVE-2016-4304

CVE-2016-4304 affects the Kaspersky Internet Security KLIF driver. A crafted NtUserCreateWindowEx call can cause an access violation in KLIF, leading to local denial of service. Exploitation can be triggered from user mode and is tied to memory access checks in the driver (TestPtrAndCopy flow). P...

CVE-2019-15685

CVE-2019-15685 affects Kaspersky Internet Security family (including Kaspersky Anti-Virus, Internet Security, Total Security, Free Anti-Virus, Small Office Security, Security Cloud up to 2020) with the Web Protection component. A web-protection input validation error allows an attacker to remotel...

CVE-2019-15688

The CVE-2019-15688 entry concerns Kaspersky’s web protection components in multiple products (Kaspersky Anti‑Virus/Internet Security/Total Security/Free etc.) where the user is not adequately informed about redirects to untrusted sites, enabling bypass of warnings. Connected sources add concrete ...

CVE-2016-4305

CVE-2016-4305 affects the Kaspersky Internet Security KLIF driver. The vulnerability lies in the driver’s syscall filtering path where the attacker-controlled TOKENPRIVILEGES.PrivilegeCount can overflow when processed (intended for NtAdjustTokenPrivileges), allowing a crafted user-mode call to tr...

CVE-2016-4307

CVE-2016-4307 affects the Kaspersky Internet Security KL1 driver (KLBG) IOCTL handling. The vulnerability arises in a loop that computes the input string length by scanning for a NULL terminator; if the input lacks a NULL within the supplied buffer, the loop reads memory beyond the buffer bounds,...

CVE-2019-15687

The CVE-2019-15687 issue affects Kaspersky consumer and security-suite products (Kaspersky Anti-Virus, Internet Security, Total Security, Free Antivirus, Small Office Security, Security Cloud up to 2020) where the Web Protection component could remotely disclose information about the user’s syste...

CVE-2017-12816

CVE-2017-12816 affects Kaspersky Internet Security for Android 11.12.4.1622. The issue arises from some application exported activities that have weak permissions, enabling a malware application to access product functionality via Android IPC. The root cause is misconfigured export permissions on...

CVE-2017-12817

In CVE-2017-12817, Kaspersky Internet Security for Android version 11.12.4.1622 stores some application trace files unencrypted, enabling information disclosure. The vulnerability is documented in multiple sources (NVD/CVE records and CNVD/National CNVD entry) across several databases, all confir...

CVE-2019-15686

CVE-2019-15686 affects Kaspersky防 antivirus/product suites (Kaspersky Anti-Virus, Internet Security, Total Security, Free Anti-Virus, Small Office Security, Security Cloud up to 2020) with a vulnerability in the Web Protection component. The connected CNVD entry describes an input validation erro...

CVE-2016-4329

CVE-2016-4329 describes a local denial-of-service in the window broadcast message handling of Kaspersky products (Anti-Virus, Internet Security, Total Security). The vulnerability arises from unhandled window messages in the AVP UI dispatcher, where certain wParam values (e.g., 8, among others li...