F-Secure
98 CVEs across 83 F-Secure products. Browse F-Secure vulnerabilities, severities, and proof-of-concept exploits.
F-Secure products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7240 | High | 7.8 | 2024-11-22 | F-Secure Total Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installati… |
CVE-2023-49322 | High | 7.5 | 2023-11-27 | Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. This affects WithSecur… |
CVE-2023-49321 | Medium | 5.3 | 2023-11-27 | Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the scanner to hang. This affects WithSecur… |
CVE-2023-43767 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Securi… |
CVE-2023-43766 | High | 7.8 | 2023-09-22 | Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server… |
CVE-2023-43765 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecu… |
CVE-2023-43761 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Emai… |
CVE-2023-43760 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecu… |
CVE-2022-47524 | Medium | 5.4 | 2022-12-23 | F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack. |
CVE-2022-45871 | Medium | 4.3 | 2022-12-13 | A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing ICAP re… |
CVE-2022-38166 | High | 7.5 | 2022-11-25 | In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler crashes. This can le… |
CVE-2022-38164 | Medium | 6.5 | 2022-11-07 | A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofin… |
CVE-2022-38163 | Low | 3.5 | 2022-11-07 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on addr… |
CVE-2022-28887 | Medium | 4.3 | 2022-10-12 | Multiple Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This c… |
CVE-2022-28886 | Medium | 4.3 | 2022-09-23 | A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking P… |
CVE-2022-28885 | Medium | 4.3 | 2022-09-06 | A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing the sca… |
CVE-2022-28884 | Medium | 4.3 | 2022-09-06 | A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files… |
CVE-2022-28883 | Low | 3.5 | 2022-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible… |
CVE-2022-28882 | Medium | 4.3 | 2022-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE… |
CVE-2022-28881 | Medium | 4.3 | 2022-08-10 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function… |
CVE-2022-28880 | Medium | 4.3 | 2022-08-05 | A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible… |
CVE-2022-28879 | Medium | 4.3 | 2022-07-22 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aepack.dll component can… |
CVE-2022-28878 | Medium | 4.3 | 2022-07-22 | A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed APK file it is possible that c… |
CVE-2022-28877 | Medium | 4.3 | 2022-07-21 | This vulnerability allows local user to delete arbitrary file in the system and bypassing security protection which can be abused for local privilege escalatio… |
CVE-2022-28876 | Medium | 4.3 | 2022-07-14 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aeheur.dll component can… |
CVE-2022-28875 | Medium | 4.3 | 2022-05-25 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can cr… |
CVE-2022-28874 | Medium | 4.3 | 2022-05-23 | Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files cause… |
CVE-2022-28873 | Medium | 4.3 | 2022-05-12 | A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window.open functionality in SAFE Browser which… |
CVE-2022-28872 | Medium | 4.3 | 2022-05-12 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the add… |
CVE-2022-28871 | Medium | 4.3 | 2022-04-25 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the fsicapd component used in certain F-Secure products while scanning larger… |
CVE-2022-28870 | Medium | 4.3 | 2022-04-15 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the add… |
CVE-2022-28869 | Medium | 4.3 | 2022-04-15 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the bro… |
CVE-2022-28868 | Medium | 4.3 | 2022-04-15 | An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted malicious webpage/URL, user may be tr… |
CVE-2021-44751 | Medium | 4.3 | 2022-03-25 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger diale… |
CVE-2021-44750 | Medium | 6.4 | 2022-03-10 | An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by adm… |
CVE-2021-44749 | Medium | 5.5 | 2022-03-06 | A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting throug… |
CVE-2021-44748 | Medium | 5.5 | 2022-03-06 | A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an a… |
CVE-2021-44747 | Medium | 4.6 | 2022-03-01 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the Fmlib component used in certain F-Secure products can crash while… |
CVE-2021-40837 | Medium | 4.6 | 2022-02-09 | A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner s… |
CVE-2021-40836 | Medium | 4.6 | 2021-12-22 | A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service. The vulnerability can… |
CVE-2021-40835 | Medium | 4.6 | 2021-12-16 | An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not car… |
CVE-2021-40834 | Medium | 4.3 | 2021-12-10 | A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAF… |
CVE-2021-40833 | Medium | 5.5 | 2021-11-26 | A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited… |
CVE-2021-40832 | Medium | 5.5 | 2021-10-08 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component used in certain F-Secure products can cr… |
CVE-2021-33603 | Medium | 5.5 | 2021-10-08 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while… |
CVE-2021-33602 | Medium | 5.5 | 2021-10-06 | A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can c… |
CVE-2021-33601 | High | 7.6 | 2021-09-28 | A vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. An authenticated user can modify settings through the web user interf… |
CVE-2021-33600 | Medium | 5.4 | 2021-09-28 | A denial-of-service (DoS) vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attack… |
CVE-2021-33599 | Medium | 4.6 | 2021-09-07 | A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes A… |
CVE-2021-33598 | Medium | 4.6 | 2021-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can cr… |
CVE-2021-33595 | Low | 3.5 | 2021-08-11 | A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other… |
CVE-2021-33594 | Low | 3.5 | 2021-08-11 | An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a le… |
CVE-2021-33597 | Low | 3.5 | 2021-08-05 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanni… |
CVE-2021-33596 | Low | 3.5 | 2021-08-05 | Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit do… |
CVE-2021-33572 | Low | 3.5 | 2021-06-21 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while… |
CVE-2020-14978 | High | 8.1 | 2020-06-23 | An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privileged XPC service, and… |
CVE-2020-14977 | High | 8.1 | 2020-06-23 | An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an attacker to perform a P… |
CVE-2020-9342 | Medium | 5.5 | 2020-02-22 | The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions bef… |
CVE-2019-11644 | High | 7.8 | 2019-05-17 | In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Se… |
CVE-2018-10403 | High | 7.8 | 2018-06-13 | An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not com… |
CVE-2018-6324 | Medium | 6.1 | 2018-02-16 | F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login. |
CVE-2018-6189 | Medium | 6.1 | 2018-02-16 | F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/la… |
CVE-2015-8264 | High | 7.8 | 2017-08-02 | Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan… |
CVE-2017-6466 | High | 8.1 | 2017-03-11 | F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrit… |
CVE-2014-2844 | | 2014-04-18 | Cross-site scripting (XSS) vulnerability in F-Secure Messaging Secure Gateway 7.5.0 before Patch 1862 allows remote authenticated administrators to inject arbi… | |
CVE-2013-7369 | | 2014-04-18 | SQL injection vulnerability in an unspecified DLL in the FSDBCom ActiveX control in F-Secure Anti-Virus for Microsoft Exchange Server before HF02, Anti-Virus f… | |
CVE-2012-6646 | | 2014-04-18 | F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified… | |
CVE-2010-5161 | | 2012-08-25 | Race condition in F-Secure Internet Security 2010 10.00 build 246 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous c… | |
CVE-2010-3499 | | 2012-08-22 | F-Secure Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote at… | |
CVE-2012-1463 | | 2012-03-21 | The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, Comodo Ant… | |
CVE-2012-1461 | | 2012-03-21 | The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0… | |
CVE-2012-1459 | | 2012-03-21 | The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677… | |
CVE-2012-1443 | | 2012-03-21 | The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symant… | |
CVE-2012-1442 | | 2012-03-21 | The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, eSafe… | |
CVE-2012-1431 | | 2012-03-21 | The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0… | |
CVE-2012-1430 | | 2012-03-21 | The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158… | |
CVE-2012-1429 | | 2012-03-21 | The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, Ikarus Virus Uti… | |
CVE-2011-1103 | | 2011-02-25 | The WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and hotfix 2 on Linux, and 9.00 before hotfix 4 o… | |
CVE-2011-1102 | | 2011-02-25 | Cross-site scripting (XSS) vulnerability in the WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and h… | |
CVE-2011-0453 | | 2011-02-18 | F-Secure Internet Gatekeeper for Linux 3.x before 3.03 does not require authentication for reading access logs, which allows remote attackers to obtain potenti… | |
CVE-2010-1425 | | 2010-04-15 | F-Secure Internet Security 2010 and earlier; Anti-Virus for Microsoft Exchange 9 and earlier, and for MIMEsweeper 5.61 and earlier; Internet Gatekeeper for Win… | |
CVE-2009-1782 | | 2009-05-22 | Multiple F-Secure anti-virus products, including Anti-Virus for Microsoft Exchange 7.10 and earlier; Internet Gatekeeper for Windows 6.61 and earlier, Windows… | |
CVE-2008-6085 | | 2009-02-06 | Integer overflow in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, when config… | |
CVE-2008-1412 | | 2008-03-20 | Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, al… | |
CVE-2008-0910 | | 2008-02-22 | Multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, F-Secure Protection Service, and others, al… | |
CVE-2008-0792 | | 2008-02-15 | Multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, F-Secure Protection Service, and others, al… | |
CVE-2007-5143 | | 2007-10-01 | F-Secure Anti-Virus for Windows Servers 7.0 64-bit edition allows local users to bypass virus scanning by using the system32 directory to store a crafted (1) a… | |
CVE-2007-3300 | | 2007-06-20 | Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070619 allow remote attackers to bypass scanning via a crafted header in a (1) L… | |
CVE-2007-2967 | | 2007-05-31 | Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070522 allow remote attackers to cause a denial of service (file scanning infini… | |
CVE-2007-2966 | | 2007-05-31 | Buffer overflow in the LHA decompression component in F-Secure anti-virus products for Microsoft Windows and Linux before 20070529 allows remote attackers to e… | |
CVE-2007-2965 | | 2007-05-31 | Unspecified vulnerability in the Real-time Scanning component in multiple F-Secure products, including Internet Security 2005, 2006 and 2007; Anti-Virus 2005… | |
CVE-2007-2964 | | 2007-05-31 | The fsmsh.dll host module in F-Secure Policy Manager Server 7.00 and earlier allows remote attackers to cause a denial of service (application crash) via NTFS… | |
CVE-2007-1557 | | 2007-03-21 | Format string vulnerability in F-Secure Anti-Virus Client Security 6.02 allows local users to cause a denial of service and possibly gain privileges via format… | |
CVE-2006-6409 | | 2006-12-10 | F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service (possibly fatal scan error), and possibly bypass virus detecti… | |
CVE-2006-3490 | | 2006-07-10 | F-Secure Anti-Virus 2003 through 2006 and other versions, Internet Security 2003 through 2006, and Service Platform for Service Providers 6.x and earlier does… | |
CVE-2006-3489 | | 2006-07-10 | F-Secure Anti-Virus 2003 through 2006 and other versions, Internet Security 2003 through 2006, and Service Platform for Service Providers 6.x and earlier allow… | |
CVE-2006-2838 | | 2006-06-06 | Buffer overflow in the web console in F-Secure Anti-Virus for Microsoft Exchange 6.40, and Internet Gatekeeper 6.40 through 6.42 and 6.50 allows remote attacke… | |
CVE-2006-0705 | | 2006-02-15 | Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0… | |
CVE-2006-0338 | | 2006-01-21 | Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 20… | |
CVE-2006-0337 | | 2006-01-21 | Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Interne… |