Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Nov 22, 2024Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability.CVE-2024-6260 · Other software · Malwarebytes · reported by zdi-disclosures@trendmicro.comHigh 7.8
Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Malwarebytes service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22321.
- Product
- Anti-Malware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmalwarebytes.comzerodayinitiative.com
Mar 12, 2024Microsoft Defender Security Feature Bypass VulnerabilityCVE-2024-20671 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Defender Security Feature Bypass Vulnerability
- Product
- Windows Defender Antimalware Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023Microsoft Windows Defender Elevation of Privilege VulnerabilityCVE-2023-36422 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Windows Defender Elevation of Privilege Vulnerability
- Product
- Windows Defender Antimalware Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Microsoft Windows Defender Elevation of Privilege VulnerabilityCVE-2023-38175 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Windows Defender Elevation of Privilege Vulnerability
- Product
- Windows Defender Antimalware Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 17, 2021Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, CVE-2021-31728 · Other software · Malwarefox · reported by MITREHigh 7.8
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018, this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2021Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write cCVE-2021-31727 · Other software · Malwarefox · reported by MITREHigh 7.8
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x80002010 and send these IOCTL's to escalate privileges by overwriting the boot sector or overwriting critical code in the pagefile.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021Windows Early Launch Antimalware Driver Security Feature Bypass VulnerabilityCVE-2021-28447 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbi-zone.medium.comportal.msrc.microsoft.com
Apr 13, 2021Windows Early Launch Antimalware Driver Security Feature Bypass VulnerabilityCVE-2021-27094 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbi-zone.medium.comportal.msrc.microsoft.com
Apr 15, 2020An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links, aka 'Windows Defender Antimalware PlatfCVE-2020-0835 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links, aka 'Windows Defender Antimalware Platform Hard Link Elevation of Privilege Vulnerability'.
- Product
- Windows Defender antimalware platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 7, 2020Untrusted Search Path vulnerability in Bitdefender High-Level Antimalware SDK for Windows allows an attacker to load third party code from a DLL library in the CVE-2020-8096 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.3
Untrusted Search Path vulnerability in Bitdefender High-Level Antimalware SDK for Windows allows an attacker to load third party code from a DLL library in the search path. This issue affects: Bitdefender High-Level Antimalware SDK for Windows versions prior to 3.0.1.204 .
- Product
- High-Level Antimalware SDK for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Jul 9, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15738 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x8000205F.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15735 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x8000206F.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15734 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x8000206B.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15733 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a NULL Pointer Dereference vulnerability due to not validating the size of the output buffer value from IOCtl 0x80002028.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15732 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x80002063.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15731 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x8000205B.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15730 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x80002067.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15729 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x8000204B.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15737 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x80002043.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 21, 2019An issue was discovered in STOPzilla AntiMalware 6.5.2.59.CVE-2018-15736 · Other software · Stopzilla · reported by MITREMedium 5.5
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x8000204F.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreyhathacker.netgreyhathacker.net
Jun 3, 2019This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711.CVE-2019-6739 · Other software · Malwarebytes · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handles URIs within certain schemes. The product does not warn the user that a dangerous navigation is about to take place. Because special characters in the URI are not sanitized, this could lead to the execution of arbitrary commands. An attacker can leverage this vulnerability to execute code in the context of the current user at medium integrity. Was ZDI-CAN-7162.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jan 15, 2019Zemana AntiMalware before 3.0.658 Beta mishandles update logic.CVE-2019-6440 · Other software · Zemana · reported by MITRECritical 9.8
Zemana AntiMalware before 3.0.658 Beta mishandles update logic.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2018An issue was discovered in MalwareFox AntiMalware 2.74.0.150.CVE-2018-6606 · Other software · Malwarefox · reported by MITREHigh 7.8
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by sending IOCTL 0x80002010 and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 3, 2018An issue was discovered in MalwareFox AntiMalware 2.74.0.150.CVE-2018-6593 · Other software · Malwarefox · reported by MITREHigh 7.8
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by connecting to the filter communication port and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges.
- Product
- Antimalware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 16, 2017An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute aCVE-2017-12312 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute arbitrary code via DLL hijacking if a local user with administrative privileges executes the installer in the current working directory where a crafted DLL has been placed by an attacker. The vulnerability is due to incomplete input validation of path and file names of a DLL file before it is loaded. An attacker could exploit this vulnerability by creating a malicious DLL file and installing it in a specific system directory. A successful exploit could allow the attacker to execute commands on the underlying Microsoft Windows host with privileges equivalent to the SYSTEM account. An attacker would need valid user credentials to exploit this vulnerability. Cisco Bug IDs: CSCvf23928.
- Product
- Advanced Malware Protection For Endpoints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Apr 9, 2013The Microsoft Antimalware Client in Windows Defender on Windows 8 and Windows RT uses an incorrect pathname for MsMpEng.exe, which allows local users to gain prCVE-2013-0078 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
The Microsoft Antimalware Client in Windows Defender on Windows 8 and Windows RT uses an incorrect pathname for MsMpEng.exe, which allows local users to gain privileges via a crafted application, aka "Microsoft Antimalware Improper Pathname Vulnerability."
- Product
- Windows Defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govdocs.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.